topic Re: Can "Firewall Policy Query" via R81.10 API? in API / CLI Discussion

Can "Firewall Policy Query" via R81.10 API?

Herschel_Liang — Wed, 13 Jul 2022 09:55:51 GMT

Is there any way run a query the on the Firewall Policy Rule Base to show only selected rules in the Rule Base, according to your criteria via R81.10 API? Can it come true on R81.10 API? The client want to achieve taget very like "Firewall Policy Query" on Smartdashboard, but he want to used via API. Criteria Values Examples: source:192.168.10.1 action:(drop) You can enter one text string, such as an object's name or IP address without delimiters. In this case, SmartDashboard shows records that contain the given criteria in all relevant fields, e.g. an IP address will be searched in Source, Destination and Install On fields of rules. One string examples: CP_default_Office_Mode_addresses_pool 192.168.10.1 http IP Addresses You can enter IPv4 address using dotted decimal or CIDR notation. Examples: 192.0.2.32 192.0.2.0/24 Off course, it do not need the same feature. Simple firewall policy query is OK. Such as we can search source and destination IP and show us match policy via API is OK. THX!

Re: Can "Firewall Policy Query" via R81.10 API?

_Val_ — Wed, 13 Jul 2022 10:32:39 GMT

Not with a single API call, but pretty achievable.

Look into "show access-rulebase" and "show access-rule" calls. You can get the policy package and then filter JSON output by additional criteria, such as source, destination, action, etc.

Re: Can "Firewall Policy Query" via R81.10 API?

Herschel_Liang — Wed, 13 Jul 2022 11:48:47 GMT

Are there any examples for the requirement? I am not a programmer .......

Re: Can "Firewall Policy Query" via R81.10 API?

_Val_ — Wed, 13 Jul 2022 13:09:13 GMT

For the mentioned API calls, look here: https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-access-rulebase~v1.8%20

Then you will have to acquire an understanding of JSON and some scripting skills, I am afraid.

Re: Can "Firewall Policy Query" via R81.10 API?

JozkoMrkvicka — Wed, 13 Jul 2022 17:17:06 GMT

As was mentioned, you can achieve this only using some script.

But there is something which might be helpful for you. There is command "fw up_execute" available which can check if desired communication is matched (accept or drop).