topic Re: Tags on Rules and Sections? in API / CLI Discussion

Tags on Rules and Sections?

Bob_Zimmerman — Wed, 25 Jan 2023 04:01:58 GMT

Looking at the documentation for management API v1.9, I see tags can be set on access layers, HTTPS layers, policy packages, and NAT sections. Meanwhile, access sections, access rules, HTTPS sections, HTTPS rules, and NAT rules make no mention of them. They all seem to have a tags field internally, but the API documentation only references the field on some of them.

Can tags be set on these objects? If nobody knows, I should be able to try it out tomorrow.

Re: Tags on Rules and Sections?

PhoneBoy — Wed, 25 Jan 2023 05:43:46 GMT

@Omer_Kleinstern should be able to tell you for sure.

Re: Tags on Rules and Sections?

Tal_Paz-Fridman — Wed, 25 Jan 2023 07:39:46 GMT

I would also recommend looking at the 3 Custom fields:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/set-access-rule~v1.9%20

Re: Tags on Rules and Sections?

Tomer_Noy — Wed, 25 Jan 2023 07:57:43 GMT

We don't currently support tags on Access rules, but we are looking at it for upcoming versions.

Re: Tags on Rules and Sections?

Bob_Zimmerman — Wed, 25 Jan 2023 13:49:15 GMT

Sure. I'm not trying to solve any particular problem, I'm just trying to learn what is possible and what isn't. I'm building something to interact with the API, and I'm trying to include local checks so the user can't even try to do things which the API simply doesn't allow. If tags on rules aren't a thing, then I simply won't let the user specify tags to set.

Also I was apparently reading some of the return values on NAT sections. They return a list of tags, but the documentation doesn't have a way to set the tags. Access sections and HTTPS sections also return a list of tags, but don't appear to have a way to set them (outside of 'set generic-object', anyway). The various rule types don't return a list of tags at all.

These little inconsistencies are driving me nuts. 😜 Most things have a comments field and a name field. Rule sections of any kind don't accept comments, but they have names. NAT rules don't have a name, but they have comments. This has led me to try to find all of the inconsistencies I can so I can handle them properly.

Re: Tags on Rules and Sections?

Bob_Zimmerman — Wed, 25 Jan 2023 17:10:21 GMT

Thanks for the confirmation! That's what I was expecting. I assume it's the case for other rule types, too.

Re: Tags on Rules and Sections?

Omer_Kleinstern — Sun, 29 Jan 2023 07:31:58 GMT

We will support tags on all rule types in the next version and in future HFA of previous versions.

Re: Tags on Rules and Sections?

faridb — Wed, 05 Mar 2025 10:31:38 GMT

Hi Omer,

it seems we do not support it yet , right ?

Farid

Re: Tags on Rules and Sections?

Omer_Kleinstern — Wed, 05 Mar 2025 11:16:46 GMT

Supported in Management API since R81.20 HFA take 26 (PMTR-89420)

Re: Tags on Rules and Sections?

faridb — Wed, 05 Mar 2025 11:55:56 GMT

thx for confirming !

so it's not possible to leverage these tags on smartconsole for simple actions like search all rules matching a specific tag ?

Re: Tags on Rules and Sections?

PhoneBoy — Wed, 05 Mar 2025 15:24:22 GMT

You can search for objects tagged with a specific tag in SmartConsole.
However, this search does not currently look at the rules themselves for tags.
As SmartConsole (at least in R81.20), doesn't support tagging a rule, I used SmartConsole CLI to tag the Stealth rule with the tag "Foobar"
You can see that I successfully did it by reviewing the API output:

I also tagged HR LAN with Foobar and did a search in SmartConsole:

As you can see, rules 3 and 8 (which include an object tagged with Foobar) show.
Rule 2 (where I applied the Foobar tag on the rule itself) does not show in the search.

Not sure if this is a bug or an RFE.