topic Re: How can we install on multiple firewalls using install policy comand from API CLI in API / CLI Discussion

How can we install on multiple firewalls using install policy comand from API CLI

nagarevathi — Wed, 22 May 2019 10:43:56 GMT

Hi Team,

I have explored the API reference posted in checkmates. It has given below command to deploy policy from API CLI to deploy on single firewall. Similarly, If we want to run policy installation on all firewalls of CMA. What is the command?

API Referrence:

https://sc1.checkpoint.com/documents/latest/APIs/index.html#gui-cli/install-policy~v1.2

Single Firewall:

mgmt_cli install-policy policy-package "standard" access true threat-prevention true targets.1 "corporate-gateway" --version 1.1 --format json

Multiple Firewall:

mgmt_cli install-policy policy-package "standard" access true threat-prevention true targets.1 "corporate-gateway corporate-gateway1 corporate-gateway2 " --version 1.1 --format json

In double quotes, can we include multiple firewalls by giving space?

Regards

Revathi

Re: How can we install on multiple firewalls using install policy comand from API CLI

PhoneBoy — Thu, 23 May 2019 01:53:44 GMT

No, you use multiple target parameters like so:

mgmt_cli install-policy policy-package "standard" access true threat-prevention true targets.1 "corporate-gateway" targets.2 "corporate-gateway1" targets.3 "corporate-gateway2 " --version 1.1 --format json

Re: How can we install on multiple firewalls using install policy comand from API CLI

nagarevathi — Thu, 23 May 2019 04:05:46 GMT

Hi Admin,

mgmt_cli install-policy policy-package "standard" access true threat-prevention true targets.1 "corporate-gateway" targets.2 "corporate-gateway1" targets.3 "corporate-gateway2 " --version 1.1 --format json

The above command will help to deploy multiple firewalls with 1 common policy. If I want to install different policies for each gateway. How we have to do that?
Policy A - Gateway A
Policy B - Gateway B
Policy C - Gateway C

Regards
Revathi

Re: How can we install on multiple firewalls using install policy comand from API CLI

ByL_telecom — Fri, 08 Jan 2021 07:37:45 GMT

Hello,

We have about 175 SMB devices (1430 devices) in our environment that share the same policy. Every time we do a change we have to install in small batches (20 devices for example) due to limitation of installing for all devices at one time.

It's possible via API to do some script or configuration to get all 1430 devices from SmartConsole and then install policy in batches of 20 devices until all of them are up-to-date?

Thanks.

Re: How can we install on multiple firewalls using install policy comand from API CLI

PhoneBoy — Fri, 08 Jan 2021 19:18:47 GMT

It’s a separate command for each gateway/policy combination.

Re: How can we install on multiple firewalls using install policy comand from API CLI

PhoneBoy — Fri, 08 Jan 2021 19:21:41 GMT

Can this be scripted? Sure.
Is there something Pre-built that does this? No.
At a high-level, you would do something like:

Query the API for the relevant gateways (maybe set a tag for each gateway with that same policy to make it easier)
Issue a policy install for the first twenty gateways.
Monitor for completion of the policy instal action and repeat for the next twenty gateways.

Re: How can we install on multiple firewalls using install policy comand from API CLI

ByL_telecom — Mon, 11 Jan 2021 11:21:09 GMT

Hello,

Which API query could we use to monitor the status of instalation?

I found a way to get the gateways and also the API command to install the policy, but can't find how to know if the policy installation is complete or not

Thanks.

Re: How can we install on multiple firewalls using install policy comand from API CLI

ByL_telecom — Mon, 11 Jan 2021 11:27:37 GMT

Forget it, I've found a way, after executing "install-policy policy-package" i can parse any of "success" messages for example and the start another installation

Re: How can we install on multiple firewalls using install policy comand from API CLI

EnriqueGB — Thu, 21 Apr 2022 11:44:18 GMT

Any chance that you share the script?

I'm scripting a related situation and it would be great to have something to compare with.

Re: How can we install on multiple firewalls using install policy comand from API CLI

allen_saldanha — Sat, 18 Jun 2022 18:54:58 GMT

can share my friend