topic Re: Checkpoint Gateway Inventory (VPN List) - automation in API / CLI Discussion

Checkpoint Gateway Inventory (VPN List) - automation

320244 — Mon, 28 Oct 2024 18:45:29 GMT

What is the best way to get the inventory of the VPN on Checkpoint Gateway Device?

I used the CLI commands VPN TU TLIST & VPN TU LIST IKE on the gateways to get the output on Terminal/SecureCRT. How can I use Python or Postman to get this information? Is there a API which I can leverage to get the information using Postman or Python?

Any suggestions is highly appreciated!

Re: Checkpoint Gateway Inventory (VPN List) - automation

PhoneBoy — Mon, 28 Oct 2024 22:08:55 GMT

You can call those same commands via REST API using run-script (either via the Management API or the Gaia API).

Re: Checkpoint Gateway Inventory (VPN List) - automation

320244 — Mon, 28 Oct 2024 22:27:38 GMT

Thank you, though I am not sure what needs to be done with the run script? the command which I want to execute is in the screen shot:

(1) List all IKE SAs

(2) List all IPsec SAs

how can we execute this commands? also if not this, what commands what can we execute to get all the VPN's in the gateway device, just like eg. "show-routes", to see all the routes in gateway configured.

Thank you!!

Re: Checkpoint Gateway Inventory (VPN List) - automation

AaronCP — Mon, 28 Oct 2024 23:42:56 GMT

Maybe you could use the API that @PhoneBoy suggested, and pass one of the VPN shell commands listed in https://community.checkpoint.com/t5/Security-Gateways/VPN-Troubleshooting-Commands/m-p/39636#M13069.

Re: Checkpoint Gateway Inventory (VPN List) - automation

PhoneBoy — Tue, 29 Oct 2024 16:54:51 GMT

run-script allows you to execute CLI commands (or a script) via REST API.
It's not meant for interactive use (which vpn tu clear is), where SSH + Paramiko might be a better option.
However, it appears the vpn shell commands will give you similar information and, thus, might be better suited for usage with run-script.

As for something that doesn't involve a CLI command (i.e. a native REST API endpoint), one does not appear to exist for this purpose.
In R82, I know we export certain VPN information through OpenTelemetry, but not sure it's what you're looking for.