topic Re: Need Help with Automating Device Information Gathering in MDS Environment in API / CLI Discussion

Need Help with Automating Device Information Gathering in MDS Environment

majorluk — Thu, 17 Oct 2024 16:22:11 GMT

Hi everyone!

I'm reaching out for some advice because I'm a bit stuck at the moment.

We have an MDS environment and are developing automation scripts for compliance checks and read/write operations. Currently, I need to list all devices across all domains and download their configurations using the MDS CLI. I then execute commands remotely on Gaia and Gaia Embedded appliances.

The challenge is that, as part of a central team, I don’t have direct access to the firewalls but still need to gather all their information (yes, I know, it’s a bit ironic given the situation!).

We’re using the API show-gateways-and-servers call to gather appliance information, but the output is quite limited. It’s missing important details like:

Serial number
MAC address
HA status (active/standby)
Exact model
Jumbo Hotfix (JHF) version
License details

I was thinking of using remote execution to gather this info manually, but with around 800-1500 gateways globally, it’s taking forever to go through them all.

Is there anything you can recommend to speed this up or make the process more efficient? Also, what specific commands can I run on Gaia, Gaia Embedded, or Gaia VM to extract all the necessary details?

Any help would be much appreciated—my brain is fried and I could really use a nudge in the right direction! 😅

Thanks a lot in advance!

Re: Need Help with Automating Device Information Gathering in MDS Environment

Amir_Senn — Sun, 20 Oct 2024 11:56:00 GMT

Can you use GAIA API for the operation?

If you do, you can use run-script API to get the info you need: https://sc1.checkpoint.com/documents/latest/GaiaAPIs/index.html#web/run-script~v1.7%20

Re: Need Help with Automating Device Information Gathering in MDS Environment

Tal_Paz-Fridman — Sun, 20 Oct 2024 12:02:40 GMT

You can also use the older cpstat command with the -h flag to would with remote Security Gateways.

cpstat might have the flags to show what you are looking for (just type cpstat and it will give the usage).

For example cpstat os -f all -h <IP address> will retrieve the OS flags from the remote machine.

Re: Need Help with Automating Device Information Gathering in MDS Environment

PhoneBoy — Mon, 21 Oct 2024 13:53:00 GMT

show-gateways-and-servers will only show you information in the Management about the object.
You might want to look into the following:

get-platform: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/get-platform~v2%20

In the Gaia API (referenceable from the Management API), you also have:

show-license: https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#web/show-licenses~v1.7%20
show-asset: https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#web/show-asset~v1.7%20
show-cluster-state: https://sc1.checkpoint.com/documents/latest/GaiaAPIs/#web/show-cluster-state~v1.7%20

R82 has an additional APIs that will help as well:

show gateway-capabilities: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-gateway-capabilities~v2%20

Hopefully that helps and will reduce your need to use run-script (also a possibility, of course).

Re: Need Help with Automating Device Information Gathering in MDS Environment

Daniel_Kuhl1 — Wed, 23 Oct 2024 05:35:29 GMT

@PhoneBoy that's a great collection of API calls for this case.

@majorluk you can combine them in a Python script for example to build your own overview based on the outputs. You don't need access to the devices themselves. For MDS, make sure to have Multi-Domain Super User rights in SmartConsole. Then you can use the show-gateways-and-servers API call to get the uids of the gateways. Those uids can be used then with the API call gaia-api to gather the details from Gaia API using Management API. Like this:

> gaia-api/show-cluster-state target "69ab02a3-ee97-4be9-b818-adbffc51dc4e" --format json { "command-name" : "show-cluster-state", "response-message" : { "additional-info" : "", "cluster-status" : "ok", "message" : "Cluster Active", "mode" : "virtual-system-load-sharing", "other-cluster-members" : [ { "load" : 0, "name" : "A-VSX-02", "peer-id" : 2, "status" : "standby" }, { "load" : 0, "name" : "A-VSX-03", "peer-id" : 3, "status" : "standby" } ], "this-cluster-member" : { "load" : 100, "name" : "A-VSX-01", "peer-id" : 1, "status" : "active" } } }

This should work in my opinion. Let me know if you need an example in Python.

Re: Need Help with Automating Device Information Gathering in MDS Environment

majorluk — Tue, 29 Oct 2024 09:51:35 GMT

Hi,

Thanks a lot for the feedback! GAIA doesn't seem to be an issue, but GAIA Embedded is a bit tricky. It doesn’t support those API calls, and the CLI commands differ from those on a typical GAIA system.

Re: Need Help with Automating Device Information Gathering in MDS Environment

majorluk — Tue, 29 Oct 2024 09:52:32 GMT

Hi,

Re: Need Help with Automating Device Information Gathering in MDS Environment

PhoneBoy — Tue, 29 Oct 2024 17:23:19 GMT

Gaia Embedded has different CLI which can called via REST API.
The CLI commands that are probably most relevant (based on your original post) are:

show diag
fw ver
cplic print
show cluster-status

Re: Need Help with Automating Device Information Gathering in MDS Environment

majorluk — Wed, 30 Oct 2024 14:43:11 GMT

Hi,

It looks like this is currently the easiest way to retrieve the data. Is there also a command available to check the Gateway cluster status and licensing? Since MDS stores that information in its database, there might be a way to access it, right?

Thanks so much!

Re: Need Help with Automating Device Information Gathering in MDS Environment

majorluk — Wed, 30 Oct 2024 15:05:02 GMT

Nevermind! Found all flags here:

cpstat

Thanks a lot!!! Saved a lot of time!!