topic Re: MDS Install Multiple Policy via REST API in API / CLI Discussion

MDS Install Multiple Policy via REST API

Burton_Peake — Mon, 23 Jul 2018 15:55:14 GMT

On the MDS GUI in R80.10, you can right click a domain and select "Install Policy" and install multiple policies. Is there a way to do this via REST API?

Re: MDS Install Multiple Policy via REST API

PhoneBoy — Mon, 23 Jul 2018 16:21:15 GMT

There is an "install-policy" action via the API, yes.

See the link to it here: Check Point - Management API reference

Re: MDS Install Multiple Policy via REST API

Burton_Peake — Mon, 23 Jul 2018 16:24:42 GMT

Will it automatically queue up the policy installs like the option in the GUI?

Re: MDS Install Multiple Policy via REST API

PhoneBoy — Mon, 23 Jul 2018 16:32:31 GMT

It should work exactly the same way as it works in the GUI.

Specifically, the API call (assuming it is valid) will return a task-id that you monitor for results using the show task API call.

Re: MDS Install Multiple Policy via REST API

Ivan_Moore — Wed, 25 Jul 2018 23:28:30 GMT

It can install it in the same way...however it will do what you tell it to do.

If you tell it to install a policy and don't give it installation targets, it will default to how that policy is configured in regards to installation targets.

Scenario: Provider-1 Domain with 3 clusters and a separate policy for each cluster.

Policy-A is configured with installation targets of Cluster-A

Policy-B is configured with installation targets of Cluster-B

Policy-C was just built and is for Cluster-C however it is not completely configured and has a Any for installation targets.

In fact, Cluster-C hasn't even been built yet, an Engineer is just working on the policy to get it ready.

Manually with Smart Console if you attempt to install Policy-C on Cluster-A or Cluster-B it will pop up a warning saying are you sure? The policy doesn't match what is installed...yada...yada

From Smart Domain Manager doing the re-assign w/ install for the whole domain would just install Policy-A and Policy-B and would ignore Policy-C.

For API, if you pull the list of packages and tell the API to install all available packages, it would Policy-A on Cluster-A. Policy-B on Cluster-B and Policy-C would install on both Cluster-A and Cluster-B and be happy about it.

Lots of power, but it will also let you shoot yourself in the foot

Re: MDS Install Multiple Policy via REST API

Tomer_Sole — Thu, 26 Jul 2018 07:56:50 GMT

This is correct. We plan to make a better experience for this in our next releases.

Re: MDS Install Multiple Policy via REST API

Ash_Sidhu — Fri, 21 Jun 2019 09:02:26 GMT

You will have to login at the domain Level... see https://community.checkpoint.com/thread/1066
Make sure to specify targets in the install command. I noticed i(n the cli) that if you do not specify target gateway, the policy is pushed to all the gateways in the domain