topic Re: Failed add-access-rule (very weird) in API / CLI Discussion

Failed add-access-rule (very weird)

pdn — Tue, 14 Nov 2023 17:35:41 GMT

Hi,

I can't figure this out so weird.

So, my python make a POST REST API add-access-rule call to the checkpoint mgmt server, for tcp port 300 (service), and it works fine (ie, I can see the rules published onto the FW).

Then, I made another POST call, same exact source/destination, but a different port, and it fails with the RuntimeError error (below). Please see the body with parameters sent with the POST call. I verified the parameters settings like the access layer, position, source/destination ID's, against the FW, all are good, like with the tcp port 300 request.

I am using R81.10, which is Management API Version v1.8. Appreciate any prompt feedbacks.

RuntimeError: 400 Client Error: Bad Request for url: https://xyx.com/web_api/add-access-rule

https://sc1.checkpoint.com/documents/latest/APIs/#web/add-access-rule~v1.8.1%20

Re: Failed add-access-rule (very weird)

pdn — Tue, 14 Nov 2023 18:32:59 GMT

I got it! One of the API sessions locked some objects. After disconnecting and discard that session, it works!!!

I hope it helps people with similar issue. Stupid thing, it costed me some good troubleshooting hours since yesterday.

Re: Failed add-access-rule (very weird)

pdn — Mon, 19 Feb 2024 14:29:13 GMT

I thought I knew the reason, but I still got the discard. Not often, just at times.

I don't believe there were locked objects, yet I still got the below error. If you have any thought, can you please share? It's frustrating to be honest, for something that is not replicated.

Is there a way to check if an object is locked, so that our app can wait for it to be unlocked first before making the add-access-rule api call?

Network access create Failed 400 Client Error: Bad Request for url: https://olanpn-mdsm00.xyz.com/web_api/discard

Thanks much in advance.

Re: Failed add-access-rule (very weird)

the_rock — Mon, 19 Feb 2024 15:16:43 GMT

I just rebooted my test lab mgmt server and worked fine.

Best,

Andy