topic Re: Block ip address using api rest in API / CLI Discussion

Block ip address using api rest

ottis79 — Tue, 20 Apr 2021 08:06:26 GMT

Hi all

It is possibile to create a rule to block a list of ips using the api rest (Web Service)?

I'm using checkpoint R80.40.

Thanks

Re: Block ip address using api rest

Jonas_Rosenboom — Tue, 20 Apr 2021 12:35:33 GMT

Have a look here: https://community.checkpoint.com/t5/API-CLI-Discussion/Blocking-TOR-exit-nodes-with-Python-and-R80-10-API/td-p/39451

The thread contains an example to manage blocklists in the rule-base, as well as providing information on other, possibly better options.

Depending on your exact use case, Custom Intelligence Feeds may also be a great solution.

Re: Block ip address using api rest

ottis79 — Tue, 20 Apr 2021 14:51:22 GMT

Hi Jonas

Thanks for your support.

One question: the script in the first link add a group in an existing rule (a block rule)?

Ottavio

Re: Block ip address using api rest

Jonas_Rosenboom — Tue, 20 Apr 2021 15:01:12 GMT

The script in the first link adds hosts to an existing group. It allows you to use a single rule at a convenient place in your rulebase. However, please take into account other options for blocking lists of IPs, most of the other solutions are better at scale and from operational efforts.

Re: Block ip address using api rest

ottis79 — Wed, 21 Apr 2021 08:07:13 GMT

Hi Jonas, thanks for your explanation.

I have a small question, I'm agree with you that the solution with rest api to create a large number of IPs is not performance way, but in my case the IPs number is very small, Can you help me to understand the api rest with steps to create a rule to block the ip?

many thanks

Ottavio

Re: Block ip address using api rest

Jonas_Rosenboom — Wed, 21 Apr 2021 13:27:00 GMT

You can find the full documentation of our API at https://sc1.checkpoint.com/documents/latest/APIs/index.html

To create a rule blocking a group of IPs take a look at these API commands:

add-group name "ExampleGroup_BlockIps" add-host name "Block_203.0.113.11" ip-address "203.0.113.11" groups "ExampleGroup_BlockIps" add-access-rule layer "Network" position "top" source "ExampleGroup_BlockIps"

Feel free to try these out in SmartConsole demo mode!

BTW:
If you are interesting in a comprehensive training, we offer course and certification focused on automating tasks with the API:

Check Point Certified Automation Specialist (CCAS)

Re: Block ip address using api rest

ottis79 — Wed, 21 Apr 2021 14:16:55 GMT

Hi Jonas

Many thanks for your help, I will try with your indications.

Is it possible to use add-object-batch with property "group" to create a list number of IPs instead send many add-host request?

Re: Block ip address using api rest

Bob_Zimmerman — Wed, 21 Apr 2021 15:16:28 GMT

I think it's worth mentioning Check Point's management API is not REST-based. If you plan to do this with a client built to make calls to arbitrary REST APIs, it won't work.

The easiest way to make calls to Check Point's API is with mgmt_cli directly on the management server. To work remotely, you will need a way to work with JSON and a way to make HTTP POST requests (cURL works).