topic Re: Security Gateway Inventory in API / CLI Discussion

Security Gateway Inventory

John_Lovinggood — Sat, 24 Feb 2018 22:53:08 GMT

About 6 months ago, CP gave us a script to run from Provider 1 to grab all gateways and their corresponding model/software version. However, it was a very inconsistent result. Meaning that, some (active) gateways came back with just host name and IP and then some came back with host name/IP/OS Version/model number.

Anybody aware of a way to pull : Gateway Info that includes (Hostname/IP/OS-Version/Model)? I know you can export a list through network objects, but I just want active count for inventory. Any such method/script?

Re: Security Gateway Inventory

Kaspars_Zibarts — Wed, 21 Mar 2018 12:15:52 GMT

Small update 27th Sep 2018 - added MAC address of Mgmt interface as requested

I got little curious since no one replied

I have only tested it with R77.30, R80.10 and R76 (chassis ver) and CP appliances...

You get semicolon separated text like this - you can format it better if you need to

You run it on MDS - it's fairly slow but I wanted to keep it as simple as possible.

Script will use cpmiquerybin to fetch all physical gateways from all CMAs and then cprid_util to run some commands to collect numbers, so it's fully autonomos - does not need any input nor extra usernames/port openings etc

I've added ugly HTML version now too in output.html

#!/bin/bash
. /opt/CPshared/5.0/tmp/.CPprofile.sh

if [ -f logfile ]; then rm logfile; fi
echo '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">' > output.html
echo '<html><head><title>Gateway Versions</title></head><body><font size="-1"><table style="text-align: left; width: 100%; font-family: Helvetica,Arial,sans-serif;" border="1" cellpadding="5" cellspacing="2"><tbody>' >> output.html
echo '<tr style="font-weight: bold; background-color: rgb(0, 0, 102); color: white;"><td>GW</td><td>IP</td><td>MODEL</td><td>MAJOR</td><td>TAKE</td><td>MAC</td></tr>' >> output.html

for CMA_NAME in $($MDSVERUTIL AllCMAs); do mdsenv $CMA_NAME; echo "CMA $CMA_NAME"; cpmiquerybin attr "" network_objects " (type='cluster_member' & vsx_cluster_member='true' & vs_cluster_member='true') | (type='cluster_member' & (! vs_cluster_member='true')) | (vsx_netobj='true') | (type='gateway'&cp_products_installed='true' & (! vs_netobj='true') & connection_state='communicating')" -a __name__,ipaddr; done 1>> logfile 2>> logfile


while read line; do

        if [ `echo "$line" | grep -c ^CMA` -gt 0 ]; then

                CMA_NAME=`echo "$line" | awk '{print $2}'`
                mdsenv $CMA_NAME

        else
                GW=`echo "$line" | awk '{print $1}'`
                IP=`echo "$line" | awk '{print $2}'`

                MODEL=`$CPDIR/bin/cprid_util -server $IP -verbose rexec -rcmd /bin/clish -s -c 'show asset system' | grep ^Model | awk -F: '{print $2}' | sed  's/ Check Point //'`
                # Fix for chassis
                if [ "x$MODEL" = "x" ]; then MODEL=`$CPDIR/bin/cprid_util -server $IP -verbose rexec -rcmd bash -c "dmiparse System Product"`; if [ "x$MODEL" = "xA-40" ]; then MODEL="41000"; fi; fi

                TAKE=`$CPDIR/bin/cprid_util -server $IP -verbose rexec -rcmd bash -c "grep 'was installed successfully' /opt/CPInstLog/DA_UI.log" | egrep "Image|Jumbo|Upgrade|Bundle_T" | tail -1 | sed 's/Take/#/' | sed 's/was/#/' | sed 's/)//' | awk -F# '{print "Take"$2}' | xargs`
                # Fix for earlier releases or when take cannot be read from DA logs
                if [ "x$TAKE" = "x" ]; then TAKE=`$CPDIR/bin/cprid_util -server $IP -verbose rexec -rcmd bash -c "cpinfo -y FW1" | grep HOTFIX | tail -1 | awk '{print $1}'`; fi

                # Fix for manually imported package installations
                if [ `echo $TAKE | wc -w` -gt 2 ]; then  TAKE=`$CPDIR/bin/cprid_util -server $IP -verbose rexec -rcmd bash -c "grep 'was installed successfully' /opt/CPInstLog/DA_UI.log" | egrep "Bundle_T" | tail -1 | sed 's/_T/#T/' | awk -F# '{print $2}' | sed 's/_/ /' | sed 's/T//' |awk '{print "Take "$1}'`; fi

                MAJOR=`$CPDIR/bin/cprid_util -server $IP -verbose rexec -rcmd bash -c "fw ver" |  sed 's/This is Check Point VPN-1(TM) & FireWall-1(R) //' | sed "s/This is Check Point's software version //" | awk '{print $1}'`

                MAC=`$CPDIR/bin/cprid_util -server $IP -verbose rexec -rcmd bash -c "ifconfig -a" | egrep "Mgmt|Internal|eth0" | head -1 | awk '{print $5}'`

                echo "$GW;$IP;$MODEL;$MAJOR;$TAKE;$MAC"
                echo "<tr><td>$GW</td><td>$IP</td><td>$MODEL</td><td>$MAJOR</td><td>$TAKE</td><td>$MAC</td></tr>" >> output.html

        fi

done < logfile

echo '</tbody></table><br></body></html>' >> output.html‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Security Gateway Inventory

Patrick_B — Mon, 02 Apr 2018 20:45:12 GMT

Hello Kaspars,

Was this script supposed to be ran in a special way? When attempting to run this I kept receiving an error regarding the command " AllCMAs". Is this specific command on a certain version of hotfix or a special add in etc? I am new to the Check Point scripting world so forgive me if the question is a little newbish.

Re: Security Gateway Inventory

Kaspars_Zibarts — Mon, 02 Apr 2018 20:57:01 GMT

Are you running MDS or regular management server? That command and script itself is meant for MDS type management.

Re: Security Gateway Inventory

PhoneBoy — Fri, 21 Jun 2019 09:18:35 GMT

You know this means I have to move this thread to https://community.checkpoint.com/community/developers?sr=search&searchId=0678ff86-08f7-4a64-86d4-c8659320f45b&searchIndex=0‌, right?

Re: Security Gateway Inventory

Tomer_Sole — Tue, 03 Apr 2018 04:11:27 GMT

mgmt_cli show gateways-and-servers details-level "full"

Check Point - Management API reference

{
 "from": 1,
 "to": 2,
 "total": 2,
 "objects": [{
 "uid": "302bcc2c-b3f1-405b-93dc-a5884288e499",
 "name": "gw_192.0.2.14",
 "type": "simple-gateway",
 "ipv4-address": "192.0.2.14",
 "operating-system": "Gaia",
 "hardware": "Open server",
 "version": "R80",
 "sic-status": "communicating",
 "interfaces": [{
 "interface-name": "eth0",
 "ipv4-address": "192.0.2.201",
 "ipv4-network-mask": "255.255.255.0",
 "ipv4-mask-length": 24,
 "topology": {
 "security-zone": {
 "uid": "237a4cbc-7fb6-4d50-872a-4904468271c4",
 "name": "ExternalZone",
 "type": "security-zone",
 "domain": {
 "uid": "a0bbbc99-adef-4ef8-bb6d-defdefdefdef",
 "name": "Check Point Data",
 "domain-type": "data domain"
 }
 },
 "leads-to-internet": true
 },
 "dynamic-ip": false
 }
 ],
 }

another option would be:

mgmt_cli run-script script-name "show configuration" script "show configuration" targets.1 "corporate-gateway"

Re: Security Gateway Inventory

Kaspars_Zibarts — Tue, 03 Apr 2018 04:22:59 GMT

Good points Tomer. The reason why I'm pulling info from gateways is that ultimately they have the "correct" information themselves about the model, SW version and take number. Else you really rely on the fact that info in the gateway object in mgmt is 100% accurate that can be misleading sometimes after upgrades when people forget to update it.. As they say - best to hear from horses mouth

https://community.checkpoint.com/people/tomera5b2e7f3-09aa-32f8-96c2-f0f5bfa2988b Can you get take number of the gateway from mgmt server btw?

Re: Security Gateway Inventory

Tomer_Sole — Tue, 03 Apr 2018 04:52:41 GMT

First of all this is good feedback for us. Consistency between gateway values defined at the Management server and the values on the gateways themselves is something we will try to emphasize better in our next releases.

You can can pull the take number by running “mgmt_cli run script” on the Management server for the script “clish -C ver” on the selected gateway targets.

Re: Security Gateway Inventory

Kaspars_Zibarts — Thu, 09 Aug 2018 05:52:46 GMT

Updated script to process manually imported jumbo hotfix packages

Re: Security Gateway Inventory

Etheldra_Freder — Thu, 13 Sep 2018 18:41:07 GMT

Where you run this command or is it related to the script? How do you run it?When I run the "mgmt._cli ...." I get an error that the command is not found.

Re: Security Gateway Inventory

PhoneBoy — Thu, 13 Sep 2018 21:21:38 GMT

mgmt_cli is run from the management (R80 and above).

If you're on an earlier release, that command won't be available.

Re: Security Gateway Inventory

Etheldra_Freder — Fri, 14 Sep 2018 12:38:11 GMT

Thanks for that clarification. I tried using the command but I got an error back that the command was not found.

Re: Security Gateway Inventory

Kaspars_Zibarts — Fri, 14 Sep 2018 14:09:43 GMT

Can you share the screenshot? You are logged into expert mode? As in bash shell?

Re: Security Gateway Inventory

Etheldra_Freder — Fri, 14 Sep 2018 14:51:23 GMT

Yes, I am.

Also we are on 77:30

Re: Security Gateway Inventory

Kaspars_Zibarts — Fri, 14 Sep 2018 16:23:49 GMT

you will need to get to R80.10 first then. API is not supported in R77.30

Re: Security Gateway Inventory

PhoneBoy — Fri, 14 Sep 2018 16:39:38 GMT

Please be aware when you respond via email, your signature may be included in the public response that gets posted to CheckMates.

I've removed this information from a couple of posts on this thread as I assume you don't want it out there

Re: Security Gateway Inventory

PhoneBoy — Fri, 14 Sep 2018 16:45:09 GMT

However, the script you provided above should work on R77.30 MDM.

If you're not on MDM, then it probably needs some modification since there isn't a cpmiquerybin binary to get the list of managed gateways.

Re: Security Gateway Inventory

Etheldra_Freder — Fri, 14 Sep 2018 17:46:35 GMT

Got it. Thanks

Re: Security Gateway Inventory

Etheldra_Freder — Fri, 14 Sep 2018 21:08:12 GMT

Thanks, I did not realize that.

Re: Security Gateway Inventory

Etheldra_Freder — Fri, 14 Sep 2018 21:11:01 GMT

I have a script SK85621 that does some of the inventory collection but it does not tell you the specific model for each firewall. I have looked at the attributes and when you use "appliance type" but I would like the specific platform from each individual ( we have a variety). Which attributes gives me that output. I see a list of attributes but not sure which one would do that (since it is not obvious to me in the list of attributes).