topic Re: Obtaining VS info from Web API run-script route called on a Gateway in API / CLI Discussion

Obtaining VS info from Web API run-script route called on a Gateway

ChadGPT — Thu, 14 Dec 2023 15:24:48 GMT

Hello everyone!

Using the management web API v1.9 and the run-script route targetted at a VSX gateway, I am able to run a command like "vsx stat -l" to get the stats of the virtual systems running on the gateway.

My problem is that when I try to run the command "vsenv [vsid]" with the run-script route, I get the error message "vsenv command not found". Why would that be ?

I am trying to move inside of a vs to then run the "ifconfig -a" via the web API and this seems to be the only path I have found yet until official APIs for VSX are released as part of R82. I am using an API Key and an API User with elevated permission to authenticate with the API.

Re: Obtaining VS info from Web API run-script route called on a Gateway

Vincent_Bacher — Thu, 14 Dec 2023 18:48:20 GMT

Hi,

Could put-file in combination with run-script be an option?

Cheers

Re: Obtaining VS info from Web API run-script route called on a Gateway

Hugo_vd_Kooij — Fri, 15 Dec 2023 09:47:18 GMT

I have noticed that commands like mdsenv and vsenv do not work as such in bash scripts these days.

Need to look into that.

Re: Obtaining VS info from Web API run-script route called on a Gateway

Jim_Oqvist — Fri, 15 Dec 2023 10:10:17 GMT

You need to sent the environment variables for the shell you are starting with run-script. this can be done by adding source /etc/bashrc ; before your command in the script value.

[Expert@sc:0]# mgmt_cli -r true -f json run-script script-name "test" script "source /etc/bashrc ; vsenv" targets.1 "sc"

Here is an example, ignore the fail as I am executing the command on a Security Management Server

[Expert@sc:0]# mgmt_cli -r true -f json run-script script-name "test" script "source /etc/bashrc ; vsenv" targets.1 "sc" | jq -r '.tasks[]."task-details"[].statusDescription'

---------------------------------------------
Time: [10:24:48] 15/12/2023
---------------------------------------------
"cpx-sc - test" failed (100%)
vsenv: This is only supported on a VSX machine.

Re: Obtaining VS info from Web API run-script route called on a Gateway

ChadGPT — Fri, 15 Dec 2023 16:44:32 GMT

Hi Jim,

You seem to be using the mgmt_cli tool, I am using the Web Services. Looking at the documentation (Check Point - Management API reference), it seems like I cannot add the source in the HTTP Request body...

Thank you

Re: Obtaining VS info from Web API run-script route called on a Gateway

ChadGPT — Fri, 15 Dec 2023 16:48:09 GMT

Hi Vincent!

What difference would it make if I were to use put-file in combination with my run-script? I would pass the script in the put-file and then I would execute that script with run-script pointing at that script. I am not sure it would make a difference at the level where the command is executed ?

Re: Obtaining VS info from Web API run-script route called on a Gateway

Jim_Oqvist — Fri, 15 Dec 2023 17:27:15 GMT

Hi,

The mgmt_cli is just a client to send RESTful API requests as HTTP POST.

This is how the payload looks like that is sent to the Server.

Payload: { "script" : "source /etc/bashrc ; vsenv", "script-name":"test", "targets":["sc"] }

Re: Obtaining VS info from Web API run-script route called on a Gateway

ChadGPT — Fri, 15 Dec 2023 18:12:08 GMT

Thank you very much, this seems to do the trick !

Re: Obtaining VS info from Web API run-script route called on a Gateway

ChadGPT — Mon, 18 Dec 2023 16:20:55 GMT

If this can help anyone: I got it to work with "src /etc/bashrc ; vsenv [vsName] ; /bin/cp-ifconfig.sh -a"
ifconfig -a gave the internal IP's. /bin/cp-ifconfig.sh -a gives me the external IP's

Re: Obtaining VS info from Web API run-script route called on a Gateway

Bob_Zimmerman — Mon, 18 Dec 2023 18:41:28 GMT

All currently supported versions of VSX are based on Linux network namespaces rather than the old VRF extensions. As long as you're running a current version, the easiest way to run a command in a given VS is this:

ip nets exec <namespace name> <command>

The namespaces have predictable names in the form CTX##### where ##### is the VSID padded out to five digits with leading zeroes. For example, VSID 4 is CTX00004 and VSID 196 is CTX00196.

For example, to run the command 'netstat -rn' in VSID 2, I use:

ip netns exec CTX00002 netstat -rn

You can get a list of all of the namespace names using 'ip nets list'. Note that this list includes switch contexts.

Re: Obtaining VS info from Web API run-script route called on a Gateway

Alex- — Tue, 19 Dec 2023 08:56:36 GMT

Useful information about the namespaces, thanks for sharing.