topic Re: How do I add a new access-section to a specific package via the api? in API / CLI Discussion

How do I add a new access-section to a specific package via the api?

SecNetEng — Sun, 26 Feb 2023 23:17:21 GMT

I use the following to add script to the first policy on my SMS, using SmartConsole API.

add access-section layer "Network" position top name "Gateways Access"
add access-section layer "Network" position bottom name "Noise Suppression"
add access-section layer "Network" position bottom name "Stealth Rule"
add access-section layer "Network" position bottom name "Internet Access"
add access-section layer "Network" position bottom name "Cleanup Rule"

Later, I created a second policy for another gateway, I want to add these access-sections to the new policy.

I find that this still adds the sections to the first policy, no matter which policy I have selected in SmartConsole.

https://sc1.checkpoint.com/documents/latest/APIs/#gui-cli/add-access-section~v1.9%20

The API does not support specifying a package.

How do I script adding access-sections to a specific policy package using SmartConsole API?

Re: How do I add a new access-section to a specific package via the api?

Hugo_vd_Kooij — Mon, 27 Feb 2023 08:32:58 GMT

It seems that hardly any command has an option to select the package. So far I only found it at

show access-rulebase

Re: How do I add a new access-section to a specific package via the api?

Chris_Atkinson — Mon, 27 Feb 2023 08:48:25 GMT

@PhoneBoy explained the context of this previously here:

https://community.checkpoint.com/t5/API-CLI-Discussion/set-a-policy-package-api/m-p/8995

Re: How do I add a new access-section to a specific package via the api?

Tal_Paz-Fridman — Mon, 27 Feb 2023 09:44:41 GMT

You need to replace the name of the layer, in the case of your example "Network" with the relevant one.

You can retrieve the name in CLI or in SmartConsole > Menu > Manage policies and layers > Layers > Access Control

For example from Cloud Demo:

Re: How do I add a new access-section to a specific package via the api?

SecNetEng — Mon, 27 Feb 2023 19:38:20 GMT

@Tal_Paz-Fridman thank you for the detailed instructions and screenshot.

The first (default) layer was "Network" in policy "Policy_one".

The new layer in "Policy_two" was actually named "Policy_two Network".

To find this I followed your instructions

You can retrieve the name in CLI or in SmartConsole > Menu > Manage policies and layers > Layers > Access Control

Under Layer details I found the correct name.

To sum up:

Not working: add access-section layer "Network" position top name "Gateways Access"
Not working: add access-section layer "Policy_two" position top name "Gateways Access"
Working: add access-section layer "Policy_two Network" position top name "Gateways Access"