topic Re: mgmt_cli in API / CLI Discussion

mgmt_cli

dotank2 — Tue, 18 Jul 2023 08:00:55 GMT

hi all,

hi trying to create very simple script.

im using command line from the smart console. i create a group and i want to add all geo policy countries i have.

i create a group using set group name "Geo-Block"

and now i want to add countries.

so i do: set group name "Geo-Block" members.add "countrie1" members.add "countries2" and its not working

the error is:

code:"generic_err_object_not_found"

message: "Requested object [countrie1] not found"

Re: mgmt_cli

Tal_Paz-Fridman — Tue, 18 Jul 2023 08:21:04 GMT

What is the version you are using? Are you trying to add to the older Geo Policy or to the Access Control Rulebase?

For adding to the Rulebase which is the recommended way you first need to import the relevant Updatable Object:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/add-updatable-object~v1.9%20

Re: mgmt_cli

dotank2 — Tue, 18 Jul 2023 09:13:55 GMT

im use management version r81.10.

i have geo policy in the shared policy. and i want to create rule in the access rule with all the countries that i want to block.

so i create a group, and I can't add country objects to the group.

and the command "show updatable-objects-repository-content" not give me the parameter of uri.

Re: mgmt_cli

dotank2 — Tue, 18 Jul 2023 09:20:02 GMT

And something strange happens, when I blocked for example Israel it worked.
Me trying to block Albania doesn't work

this is work: set group name "Geo-Block" members.add "israel"

this is now working: set group name "Geo-Block" members.add "albnia"

Re: mgmt_cli

the_rock — Tue, 18 Jul 2023 12:51:00 GMT

In the command, you mispelled Albania...it shows albnia

Re: mgmt_cli

Bob_Zimmerman — Tue, 18 Jul 2023 15:15:36 GMT

Another important note. This syntax:

mgmt_cli ... members.add "country1" members.add "country2"

won't actually work. You need to specify it like this:

mgmt_cli ... members.add.1 "country1" members.add.2 "country2"

Re: mgmt_cli

the_rock — Tue, 18 Jul 2023 15:49:40 GMT

Thats it, just verified!

Re: mgmt_cli

dotank2 — Wed, 19 Jul 2023 05:32:17 GMT

thank you for your response.

i do the command:

set group name "Geo-Block" members.add.1 "Albania" members.add.2 "Algeria"

and the error is same:

code: "generic_err_object_not_found"
message: "Requested object [Albania1] not found"

Re: mgmt_cli

dotank2 — Wed, 19 Jul 2023 05:43:14 GMT

also i do ssh to the managment.

and same command i get an error:

"Authentication to server failed."

but the username is correct and i have permission "GAIA api"

Re: mgmt_cli

Hugo_vd_Kooij — Wed, 19 Jul 2023 06:16:38 GMT

Can you break down the chnage into adding 1 country per line? That is how I would do it anyway as I can then loop over a list. Be it 1 or 10 or 100 countries it will be the same code.

Re: mgmt_cli

dotank2 — Wed, 19 Jul 2023 06:43:26 GMT

i try it, also don't works

Re: mgmt_cli

dotank2 — Wed, 19 Jul 2023 09:29:42 GMT

updating

The script works only on objects built in the system.

The problem is that it is an updateable object, for example countries.

That is, I do the command:
mgmt_cli set group name "Geo-Block" members.add.1 "host1" members.add.2 "host2" > working

And I do the command:
mgmt_cli set group name "Geo-Block" members.add.1 "Togo" members.add.2 "Tunisia" > not working

And I get a message that it can't find the object.

Now the strange thing is, I do the command:
set group name "Geo-Block" members.add "israel" it works (only on Israel, when I change the country for example Togo, it doesn't work)

Re: mgmt_cli

Tal_Paz-Fridman — Wed, 19 Jul 2023 09:56:50 GMT

Did you import the relevant Updatable Object into the database?

https://sc1.checkpoint.com/documents/latest/APIs/#cli/add-updatable-object~v1.9%20

Re: mgmt_cli

the_rock — Wed, 19 Jul 2023 11:51:35 GMT

I just tested on R81.20 mgmt server and it failed as well...weird

[Expert@QUANTUM-MANAGEMENT:0]# mgmt_cli set group name "geo-block-test" members.add "albania"
Username: admin
Password:
code: "generic_err_object_not_found"
message: "Requested object [geo-block-test] not found"

Executed command failed. Changes are discarded.
[Expert@QUANTUM-MANAGEMENT:0]#

Re: mgmt_cli

_Val_ — Wed, 19 Jul 2023 12:06:11 GMT

You need to fetch the category first. Did you?

Re: mgmt_cli

the_rock — Wed, 19 Jul 2023 12:07:28 GMT

Hey Val,

Can you clarify what you are referring to exactly?

Cheers,

Andy

Re: mgmt_cli

Tal_Paz-Fridman — Wed, 19 Jul 2023 14:24:10 GMT

Description

Import an updatable object from the repository to the management server. This operation takes effect immediately and doesn't require publishing.

https://sc1.checkpoint.com/documents/latest/APIs/#cli/add-updatable-object~v1.9%20

Re: mgmt_cli

Bob_Zimmerman — Wed, 19 Jul 2023 14:55:53 GMT

That message is saying the group you're trying to add the member to doesn't exist. 'set' won't create a group.

Re: mgmt_cli

the_rock — Wed, 19 Jul 2023 15:00:03 GMT

@Bob_Zimmerman ...layer 8 problem Homer Simpson moment...DUH lol

Anyway, command @dotank2 gave did actually work now

[Expert@QUANTUM-MANAGEMENT:0]# mgmt_cli set group name "geo-group-test" members.add.1 "Togo" members.add.2 "Tunisia"
Username: admin
Password:

---------------------------------------------
Time: [10:59:37] 19/7/2023
---------------------------------------------
"Publish operation" succeeded (100%)
[Expert@QUANTUM-MANAGEMENT:0]#

Andy

Re: mgmt_cli

Bob_Zimmerman — Wed, 19 Jul 2023 15:15:19 GMT

That error indicates the command you actually ran was slightly different. Something like this:

set group name "Geo-Block" members.add.1 "Albania1"

After running this:

[Expert@DallasSA]# mgmt_cli -f json -r true update-updatable-objects-repository-content ... [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 0 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 500 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 1000 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 1500 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 2000 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 2500 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 3000 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 3500 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# mgmt_cli -f json -r true show updatable-objects-repository-content details-level full limit 500 offset 4000 | jq -c '.objects[]|.' >> updatable.json [Expert@DallasSA]# wc -l updatable.json 4249 updatable.json [Expert@DallasSA]# grep "GEO Locations" updatable.json | jq '."name-in-updatable-objects-repository"' | sort "Afghanistan" "Africa" "Aland Islands" "Albania" "Algeria" "American Samoa" "Andorra" "Angola" "Anguilla" "Antarctica Other" "Antarctica" ...

you can see all of the country object names. Each country object must be imported via 'mgmt_cli ... add updatable-object uid-in-updatable-objects-repository <UUID>' before you can actually use it. Once imported, the names will be as above.