topic Re: Policy/Object Automation Approach in API / CLI Discussion

Policy/Object Automation Approach

AaronCP — Wed, 07 Jun 2023 06:48:44 GMT

Morning all,

I am looking at various ways of automating policy changes using the Management API. We currently receive scoping requests via an excel spreadsheet, which details what objects are to be created/rules added, etc.

I've modified the excel file so that it will generate the mgmt_cli output, which saves time, but isn't full automation.

I'd like to utilise tools like PowerAutomate, Postman, etc. I'm interested in hearing how the community approach their policy automation.

Any ideas/suggestions welcomed 🙂.

Thanks.

Re: Policy/Object Automation Approach

PhoneBoy — Wed, 07 Jun 2023 15:33:55 GMT

You can feed a CSV file to mgmt_cli, but it has to be formatted correctly.
But, like you said, that's not full automation.

We do provide Postman collections for the various versions of the Management API: https://community.checkpoint.com/t5/API-CLI-Discussion/Postman-Collections-links-to-all-available-and-the-basics/m-p/40923#M2785

I'm also curious about how companies are approaching this topic as well as anything we (Check Point) can do to better support these efforts.

Re: Policy/Object Automation Approach

the_rock — Wed, 07 Jun 2023 15:55:03 GMT

Great question mate! Let us know what you find, as I also had client ask me this question before.

Cheers,

Andy

Re: Policy/Object Automation Approach

Bob_Zimmerman — Wed, 05 Jul 2023 20:05:40 GMT

What you're talking about is called "glue code". It hooks up a ticket system to a firewall management server, for example. This code tends to be very environment-specific, because there aren't a lot of companies using the same set of tools. For example, my current company has gone through at least five ticket tracking systems in the last ten years. The code also tends to be fairly proprietary, and not very high-quality. Not sure you'll find any which already exists to hook into your existing workflow, and if you did, I'm not sure I would trust it.

A few companies like Tufin and HashiCorp make a sort of "API broker" tools which talk to many tools on the back-end. They then present a subset of those tools' capabilities via a consistent API, thereby reducing the amount of glue code you have to write to deal with multiple back-end platforms. I don't know of anything similar which talks to many ticket systems and gives you one reactive programming platform to deal with events in any of them.