topic Re: CLI Help in API / CLI Discussion

CLI Help

Edwin_Graham — Mon, 23 Oct 2017 15:41:03 GMT

Hey everybody,

I am new to Checkpoint CLI and I want to organize and view certain things.

How would I be able to view all network objects, rules, etc?

I guess what commands would I use?

Re: CLI Help

PhoneBoy — Mon, 23 Oct 2017 21:03:43 GMT

The answer is largely version dependent.

If your management is R80+, then I'd start with the mgmt_cli tool, documented here: Check Point - Management API reference

If you're using R77.30 and earlier, then I'd start with the dbedit command, documented here: Command Line Interface R77

I would also have a look through the Developers (Code Hub)‌ space, which has a lot of discussion on the API/CLI.

Re: CLI Help

Prashan_Attanay — Wed, 25 Oct 2017 04:17:29 GMT

What is the checkpoint equal-ant command to cisco command show running-config ?

Re: CLI Help

PhoneBoy — Wed, 25 Oct 2017 11:16:42 GMT

From an OS perspective (network/routing), you can use the the clish command show configuration.

Depending on the version, you may not be able to use this (as is) to recreate the running configuration.

For the security gateway functions, there is no equivalent to show running-config on Cisco IOS.

This configuration is only stored on the local gateway in compiled form and cannot easily be dumped.

Re: CLI Help

Manny_Mekala — Wed, 02 Jan 2019 01:47:35 GMT

Hi Dameon,

We are on R80+ for Mgmt and the Mgmt API reference you have pointed doesn't really help in listing all network objects...There is a limit on the number of items listed 0-500 ad even then the output doesnt list the objects and their members. it only displays the object names which we can export form smart console\object explorer anyways.

Re: CLI Help

PhoneBoy — Wed, 02 Jan 2019 05:19:41 GMT

Yes, the API has a limit to the number of items that can be output at once.

You would need to iterate with multiple API calls using the offset parameter to get the next 500 objects.

You also have to request the correct detail level in the API and correctly parse the output.

One example that exports various objects in CSV format: CLI API Example for exporting, importing, and deleting different objects using CSV files (v 00.29.02 and later)‌

Re: CLI Help

Manny_Mekala — Fri, 04 Jan 2019 00:28:04 GMT

Thank you for the link... Unfortunately my current access is RO for all FW's we manage and cant get to expert mode to be able to execute those commands/scripts in the links shared. Will have to request our service provider for what i am after.

Re: CLI Help

PhoneBoy — Fri, 04 Jan 2019 04:34:02 GMT

You can do this with the API, but you're going to have to make successive API calls, like I said.

I managed to do the following from the CLI of a different Linux host (not the management server) running bash.

This assumes that "curl" and "jq" are installed, which are fairly common utilities (curl fetches web content, jq parses JSON output).

SID=`curl --silent --insecure -XPOST "https://10.6.5.250/web_api/v1.3/login" --data-binary "{\"user\": \"aa\", \"password\": \"aaaa\" }" -H "Content-Type: application/json" | jq -r .sid`
curl --silent --insecure -XPOST https://10.6.5.250/web_api/v1.3/show-hosts --data-binary "{ \"offset\": 0, \"limit\": 500, \"details-level\": \"full\" }" -H "Content-Type: application/json" -H "X-chkp-sid: $SID" | jq -r '.objects[] | .name + "," + ."ipv4-address"'
curl --silent --insecure -XPOST "https://10.6.5.250/web_api/v1.3logout" --data-binary "{}" -H "Content-Type: application/json" -H "X-chkp-sid: $SID"

The first command (starting with SID) does a login to the API with username aa / password aaaa, obtaining a session ID, and storing it in the shell variable SID.

The second command calls curl and will fetch the first 500 host objects from the management and output the name and IPv4 address of the object in a comma separated list.

You will need to repeat this command with different values for offset until you get all the objects.
You will also need similar commands to get other object types (e.g. networks, groups).
This is where the API documentation will help you: Check Point - Management API reference

The third command (also a curl command) issues a logout command, invalidating the SID.

There are probably programmatic ways to automate this further, but that should get you started.

Re: CLI Help

Manny_Mekala — Tue, 30 Apr 2019 04:32:27 GMT

Hi PhoneBoy,

Finally gave this a try, Looks like having only 'Read Only' access isn't helping. I kept getting 'Null SID' error and tested in another tool (Postman) only to figure out that i do not have access to login via API.

Is there a tool in pipeline to allow read only users have access to take information dumps from the Management server, similar to the old 'Web Visualisation tool'?

R77.30 export all rules into excel.

dannyclee — Tue, 27 Aug 2019 16:53:21 GMT

Phoneboy. Hope all is well. Can you direct an old networking dude, no scripting background on how to export all the rules into a spreadsheet that I can see source, dest and ports? I need to upgrade and I want all of the rules sets in had to check one by one afterwards. Nothing else matters as far as content...just what I have noted above. Many Thanks!

Re: CLI Help

PhoneBoy — Tue, 27 Aug 2019 20:56:02 GMT

There is a specific permission for API access.
If your permission profile has this enabled, you will have API access consistent with the other permissions in the permissions profile.

Re: R77.30 export all rules into excel.

PhoneBoy — Tue, 27 Aug 2019 20:57:57 GMT

odump/ofiller.
https://community.checkpoint.com/t5/Policy-Management/Exporting-Importing-R77-x-and-Earlier-Configuration-odumper-and/m-p/51536

Re: R77.30 export all rules into excel.

Danny — Tue, 27 Aug 2019 21:06:58 GMT

Personally I prefer WebVis R77.x to export all rules, objects and services into either a single html page (cpdb2html) or xml files (cpdb2web). Should be easy to copy the rules into Excel from HTML.

Re: R77.30 export all rules into excel.

dannyclee — Tue, 27 Aug 2019 21:29:29 GMT

Thanks Danny how does one use this tool? I believe I have the tool but I have never used it. Thanks Danny.

Re: R77.30 export all rules into excel.

Timothy_Hall — Wed, 28 Aug 2019 12:17:12 GMT

The old confwiz tool might be another viable option:

https://downloads.checkpoint.com/dc//filedetails.htm?ID=12945&product=Confwiz&version=1007&os=1074&appID=4