topic Re: Can someone put together a script to delete automatically created networks? in API / CLI Discussion

Can someone put together a script to delete automatically created networks?

Vladimir — Mon, 04 Mar 2019 14:43:23 GMT

Scripting gurus, should one of you have a chance, please help with the script for identification and deletion of the automatically created network objects.

These are created based on topology of the gateways and/or static routes.

When "get interfaces with topology" is executed or when newly deployed gateway objects with static routes are created, number of networks starting with "Net_" are created that is impossible to delete from SmartConsole, but are present and visible in the group membership selection window.

I suspect that the script to identify and remove those will be welcome, especially if it could differentiate between automatically created objects and those defined manually or via scripts, even if using same prefix.

Thank you,

Vladimir

Re: Can someone put together a script to delete automatically created networks?

Kaspars_Zibarts — Tue, 05 Mar 2019 15:22:44 GMT

They are kept there for revision rollbacks so probably not too smart to delete them.. But otherwise you would have to use dbedit commands as API does not show "hidden" networks created by automatic topology process. If you look at this bit "cdm_auto_calculated", true will hide the object from being visible in console / API

you can list all the "invisible" networks that are not used in any groups using this one-liner

names=($(echo -e "query network_objects,cdm_auto_calculated='true'\n-q\n" | dbedit -local | grep "Object Name:" | sed 's/Object Name: //')); for name in "${names[@]}"; do if [ `echo -e "whereused network_objects $name\n-q\n" | dbedit -local | grep -c "Numebr of results: 0"` -eq 1 ] && [ `echo -e "print network_objects $name\n-q\n" | dbedit -local | grep -c "type: group"` -eq 0 ]; then echo $name; fi; done

It will be fairly slow as it's running dbedit commands. To delete you will have to replace last echo used to print out with

echo -e "delete network_objects $name\n-q\n" | dbedit -local

I would not run it in production without lab testing. Worked OK on some CMAs that i tried on

Re: Can someone put together a script to delete automatically created networks?

Vladimir — Tue, 05 Mar 2019 15:42:37 GMT

Jeez, Kaspars, that one-liner wouldn't fit in a twitter post

Dameon Welch-Abernathy claims that these objects could be deleted via API. I'd like to hear from him if the deletion requires manual definition of the objects or if 1.3 allows us to pull those out and feed them into delete object.

Re: Can someone put together a script to delete automatically created networks?

Kaspars_Zibarts — Tue, 05 Mar 2019 19:42:08 GMT

Could be. I only looked at 1.1 / R80.10 and that did not show those objects.

Re: Can someone put together a script to delete automatically created networks?

PhoneBoy — Wed, 06 Mar 2019 06:45:07 GMT

I was able to do it in R80.10 from the CLI, (and thus the API) as I recall.

Haven't seen the issue again to validate.

Re: Can someone put together a script to delete automatically created networks?

Kaspars_Zibarts — Wed, 06 Mar 2019 07:43:42 GMT

100% correct - it was only Console that hides some nets, not API. So I can take my words back

Whereas API and dbedit return two extra

But it is visible in the group it's used in Console

Is this a Console bug Dameon? I know it worked OK in R77.30

Re: Can someone put together a script to delete automatically created networks?

Kaspars_Zibarts — Wed, 06 Mar 2019 09:49:25 GMT

I guess the only limitation with API is that we cannot see if network was created by topology generation process:

compare to dbedit:

Re: Can someone put together a script to delete automatically created networks?

Ari_Heber — Wed, 06 Mar 2019 17:42:10 GMT

Hi Vladimir,

I'd like to refer you to sk126872 id you have not read it yet. It is important to understand why these objects are exist and make sure you do not use them before you delete them.

You can contact Check Point support in order to get this done.

Ari

Re: Can someone put together a script to delete automatically created networks?

Vladimir — Wed, 06 Mar 2019 19:07:39 GMT

Thank you Ari Heber‌. Unfortunately, these objects are being created not only when you perform "Get Interfaces with Topology" , but as I have described earlier, also during creation of the gateway objects with static routes already pre-provisioned.

These network objects are conflicting with scripted ingestion of the actual network objects with intended properties defined.

What I would like to know is that if it is safe to delete those using Kaspar's suggested one-liner if they are NOT used in the topologies of the gateways (i.e. topology of each was re-defined manually with custom groups containing manually created networks).

In a situation where multiple gateways destined for different sites, it is necessary to provision them with routes allowing communication with the management server.

Changing their properties individually via GuiDBedit is not really a viable option.

Regards,

Vladimir

Re: Can someone put together a script to delete automatically created networks?

Ari_Heber — Thu, 07 Mar 2019 19:01:05 GMT

Hi Vladimir,

These 2 flows are actually the same flow; when initializing a SIC with remote gateway the interfaces and the routes are fetched automatically by the management (same as in Get Interfaces With Topology).

Using the one-liner command is quite safe, the operation will fail if the object is used by an interface.

Ari

Re: Can someone put together a script to delete automatically created networks?

Maxim_Tremblay — Tue, 12 Jul 2022 18:25:31 GMT

Does anyone know how to simply disable the auto-creation of these objects? These objects pollute our database too much, especially when we have more than 300 GW.