topic Re: Mgmt_Cli to create VPN directional Match condition in API / CLI Discussion

Mgmt_Cli to create VPN directional Match condition

SalmanKaleem — Wed, 10 Feb 2021 17:27:18 GMT

Create an access rule/set an access rule using Mgmt_Cli to create VPN directional Match condition

Re: Mgmt_Cli to create VPN directional Match condition

PhoneBoy — Thu, 11 Feb 2021 02:03:39 GMT

VPN Directional Match is a global property, described here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100726&partition=Basic&product=IPSec
There isn't an official API to actually set this global property, but I believe these can be set with generic-objects.
You can get a list of the properties from here: https://community.checkpoint.com/t5/API-CLI-Discussion/How-to-Query-Global-Properties-via-CLI/m-p/3766#M357

Directional Match rules are described in the API documentation for set-access-rule.
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/set-access-rule~v1.7%20
However, I don't see any specific examples of how to set it using mgmt_cli.
@Omer_Kleinstern can you provide a more precise example here?

Re: Mgmt_Cli to create VPN directional Match condition

SalmanKaleem — Thu, 11 Feb 2021 08:40:43 GMT

@PhoneBoy Thanks for additional details. Actually, we are automating the deployment of checkpoint auto scaling clusters that require creation of controllers, templates & policies. We are stuck with following VPN rule creation.

mgmt_cli set access-rule name "tgw-community VPN Traffic Rule" layer "Network " vpn add directional from "tgw-community" to "External_clear" -s sid.txt

What are we missing with the above rule as per https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/set-access-rule~v1.7%20

mgmt_cli set access-rule name "tgw-community VPN Traffic Rule" layer "Network " vpn add directional from "tgw-community" to "tgw-community" -s sid.txt

Setting Value

Source Any

Destination Any

VPN
(Directional Match)
tgw-community -> tgw-community
tgw-community -> External_clear

Services & Applications Any

Action Accept

Track Log

Re: Mgmt_Cli to create VPN directional Match condition

PhoneBoy — Thu, 11 Feb 2021 17:46:57 GMT

Keep in mind mgmt_cli is turning your CLI command into JSON name/value pairs.
So it's possibly something like:

mgmt_cli set access-rule name "tgw-community VPN Traffic Rule" layer "Network " vpn add directional.from "tgw-community" directional.to "tgw-community" -s sid.txt

mgmt_cli set access-rule name "tgw-community VPN Traffic Rule" layer "Network " vpn add directional.0.from "tgw-community" directional.0.to "tgw-community" -s sid.txt

Re: Mgmt_Cli to create VPN directional Match condition

SalmanKaleem — Mon, 15 Feb 2021 10:03:20 GMT

I get this error for both directional.0.from & directional.from

mgmt_cli set access-rule name "tgw-community VPN Traffic Rule" layer "Network" vpn add directional.0.from "tgw-community" directional.0.to "tgw-community" -s sid.txt
code: "generic_err_invalid_parameter_name"
message: "Unrecognized parameter [directional]"

Re: Mgmt_Cli to create VPN directional Match condition

PhoneBoy — Mon, 15 Feb 2021 18:19:43 GMT

@Omer_Kleinstern can you help with the correct syntax in this case?

Re: Mgmt_Cli to create VPN directional Match condition

chkp-royl — Tue, 16 Feb 2021 08:58:54 GMT

Hi Salman,

When working with mgmt_cli tool, the path to each parameter should be followed with "."

Try this:

mgmt_cli set access-rule name "tgw-community VPN Traffic Rule" layer "Network" vpn.add.directional.0.from "tgw-community" vpn.add.directional.0.to "tgw-community" -s sid.txt

Roy

Re: Mgmt_Cli to create VPN directional Match condition

Harshpal_Bhati — Mon, 22 Feb 2021 05:25:05 GMT

For other user above syntax was worked for salman .