topic Re: cli command to install policy in API / CLI Discussion

cli command to install policy

Ihenock1011 — Mon, 22 Apr 2024 18:30:41 GMT

Hi Mates,

We have a Check Point R81.10 Security Gateway and Smart Management Server (SMS) functionality. I can successfully import multiple objects using the CLI command sk113078. However, I'm looking for the syntax to install a security policy on individual VSX (Virtual Security Appliance) members within the VSX cluster.

Thanks

Re: cli command to install policy

the_rock — Mon, 22 Apr 2024 18:50:59 GMT

Not sure if its doable, as I only see option for regular gateways.

Andy

https://sc1.checkpoint.com/documents/latest/APIs/#cli/install-policy~v1.9.1%20

Re: cli command to install policy

PhoneBoy — Mon, 22 Apr 2024 18:56:23 GMT

This endpoint should also apply for VSes as well.
What isn't in the API for VSes are the VSes themselves.
Of course, VS objects are dead once you move to VSnext 😉

Re: cli command to install policy

Vincent_Bacher — Tue, 23 Apr 2024 08:21:37 GMT

@PhoneBoy wrote:
This endpoint should also apply for VSes as well.

Yes. As the policy package name is the only required argument for this API command, it's installed on the policy target defined in the policy package and each policy (rule) if defined, no matter if it's a legacy device or vs.
At least that's how I understand the API

@PhoneBoy wrote:
Of course, VS objects are dead once you move to VSnext 😉

Huh? What do you mean?

Re: cli command to install policy

_Val_ — Tue, 23 Apr 2024 09:37:42 GMT

@Vincent_Bacher , in his second note, Dameon is referring to the new virtualization solution for security gateways, VSNext, which is coming to replace VSX (or, more correctly, coexist with the classic VSX for a while) in R82.

VSNext uses a completely different provisioning and management framework, bringing the use of APIs for a virtual GW to the same level as for a physical one, and even adding more capabilities.

For more details, you can refer to one of the CPX sessions for the matter: https://community.checkpoint.com/t5/Member-Exclusive-Content/R82-ElasticXL-and-VSNext-Generation-Under-the-Hood/m-p/208170#M300

Re: cli command to install policy

Vincent_Bacher — Tue, 23 Apr 2024 09:46:48 GMT

@Val yes i know, thanks. I maybe just misunderstood "VS objects are dead"

Re: cli command to install policy

_Val_ — Tue, 23 Apr 2024 09:54:43 GMT

while @PhoneBoy is still sleeping, I can assume, he meant VSX has no future.

Re: cli command to install policy

PhoneBoy — Tue, 23 Apr 2024 14:29:14 GMT

A VS is represented as a regular gateway object in VSnext.
Thus my "VS objects are dead" comment 🙂