topic Re: Gaia API Ansible Collection 3.0.0 in API / CLI Discussion

Gaia API Ansible Collection 3.0.0

Simon_Macpherso — Fri, 12 Aug 2022 04:44:36 GMT

I see Gaia API Ansible Collection 3.0.0 (https://galaxy.ansible.com/check_point/gaia) was released over a month ago.

There is no module documentation link for this collection in the Ansible docs collection index or GitHub page.

Why release a new version without simultaneously releasing the module documentation? Supported parameters can be gleaned from the Gaia API reference documentation, but the module documentation is required for to reference support module parameters.

For example, how do you target specific gateways? When using the cp_gaia_user module I've tried to use the 'targets' parameter to target specific gateways, however a message is returned stating the parameter is unsupported.

Re: Gaia API Ansible Collection 3.0.0

PhoneBoy — Fri, 12 Aug 2022 21:59:31 GMT

@chkp-royl can you comment?

Re: Gaia API Ansible Collection 3.0.0

Simon_Macpherso — Tue, 16 Aug 2022 11:03:19 GMT

@chkp-royl are you able to comment here?

Re: Gaia API Ansible Collection 3.0.0

chkp-royl — Tue, 16 Aug 2022 12:25:15 GMT

Hi,

Sorry but we are not the owners of GAIA APIs.

Please talk to @CHKP-majds (majds@checkpoint.com) - I also sent him link to this post.

Thanks!

Re: Gaia API Ansible Collection 3.0.0

ameera — Wed, 17 Aug 2022 04:57:06 GMT

targets is not a parameter of cp_gaia_user module

we are signed up to Ansible and provide our gaia APIs to configure one gateway, but how to target specific gateways this should be Ansible work and should be in their documentation

for our documentation we are still waiting for Ansible approval to release it officially

it is right the collection now is in Ansible galaxy, but it is still not officially released, once they release it, the documentation should be part of it

thanks

Re: Gaia API Ansible Collection 3.0.0

Simon_Macpherso — Wed, 17 Aug 2022 23:28:03 GMT

Hello @ameera this doesn't really make sense. The collection leverages the mgmt api so there must be a way to target specific gateways, as there is with the web api collection (module target parameter). You mention you "provide our gaia APIs to configure one gateway" - how do you connect to a single gateway via the mgmt api to process gaia api commands?

Re: Gaia API Ansible Collection 3.0.0

ameera — Thu, 18 Aug 2022 04:39:58 GMT

this is what I did:

I added the following lines to "/etc/ansible/hosts" in ansible machine

[check_point]
172.23.21.103
[check_point:vars]
ansible_httpapi_use_ssl=True
ansible_httpapi_validate_certs=False
ansible_user=<user_name>
ansible_password=<password>
ansible_network_os=check_point.gaia.checkpoint

again, this is in ansible machine which should configure the gateways

now how to add more than one gateway I don't know

maybe you just want to add more IPs under [check_point], but I didn't try that

Re: Gaia API Ansible Collection 3.0.0

Simon_Macpherso — Thu, 18 Aug 2022 04:59:11 GMT

I was under the impression, based on the README of the collection and github repo, that this new collection would allowed control of a gateway using management web-services API.

So Ansible hosts file would be configured as below

[check_point]
%CHECK_POINT_MANAGEMENT_SERVER_IP%
[check_point:vars]
ansible_httpapi_use_ssl=True
ansible_httpapi_validate_certs=False
ansible_user=%CHECK_POINT_GAIA_USER%
ansible_password=%CHECK_POINT_GAIA_PASSWORD%
ansible_network_os=check_point.gaia.checkpoint

Meaning you would target the gateways in the yaml via the targets parameter.

https://galaxy.ansible.com/check_point/gaia

https://github.com/CheckPointSW/CheckPointAnsibleGAIACollection

Re: Gaia API Ansible Collection 3.0.0

Hugo_vd_Kooij — Thu, 18 Aug 2022 06:31:52 GMT

This is basic Ansible stuff in my view.

Howabout

[check_point]
10.0.0.2
10.0.0.3
10.0.0.12
10.0.0.23

Re: Gaia API Ansible Collection 3.0.0

Hugo_vd_Kooij — Thu, 18 Aug 2022 06:33:51 GMT

Now it is up to your playbook to determine which settings needs to be done on all hosts and which are done per host.

Re: Gaia API Ansible Collection 3.0.0

Simon_Macpherso — Thu, 18 Aug 2022 23:43:18 GMT

@ameera can you please check this internally.

Re: Gaia API Ansible Collection 3.0.0

Will_H — Fri, 19 Aug 2022 03:53:14 GMT

Understood the same. Never figured it out...

Re: Gaia API Ansible Collection 3.0.0

Simon_Macpherso — Mon, 22 Aug 2022 23:45:22 GMT

@ameera ?

Re: Gaia API Ansible Collection 3.0.0

Chris_Atkinson — Tue, 23 Aug 2022 00:51:19 GMT

Can you highlight the confusing part in the readme regarding targets?

Rather if the intent of the corresponding GAiA API is unclear please refer sk143612.

Re: Gaia API Ansible Collection 3.0.0

ameera — Wed, 24 Aug 2022 05:48:12 GMT

maybe you are referring to management API ?

it is another collection differ from gaia collection
https://galaxy.ansible.com/check_point/mgmt

https://github.com/CheckPointSW/CheckPointAnsibleMgmtCollection

Re: Gaia API Ansible Collection 3.0.0

Simon_Macpherso — Wed, 24 Aug 2022 11:35:54 GMT

No I'm not referring to the management API.

We already use the management API extensively.

Re: Gaia API Ansible Collection 3.0.0

Bob_Zimmerman — Wed, 24 Aug 2022 14:31:06 GMT

With the Gaia API, you don't necessarily use the management server's IP, you use the IP of the thing you're trying to work with. For example, you could use Ansible with the Gaia API to set the login banner. The login banner can be set on management servers and on firewalls. If you want to set it on a firewall, your Ansible configuration needs to include the IP (or name, if you have DNS) of that firewall.

Re: Gaia API Ansible Collection 3.0.0

ameera — Thu, 25 Aug 2022 03:11:25 GMT

maybe the %CHECK_POINT_MANAGEMENT_SERVER_IP% is confusing and it was misunderstand able

we are referring it to any gaia IP ( firewall IP or management IP )