topic Re: BASH Framework for Management API Commands in API / CLI Discussion

BASH Framework for Management API Commands

Bob_Zimmerman — Sat, 21 Jan 2023 16:19:54 GMT

I'm working on a program which interacts with Check Point's management API. As is common when programming anything substantial, I built some smaller tools to help me along the way. I thought I would share one, since it has broad applicability.

This is a script framework to abstract away some management API implementation details and concerns which annoyed me. Specifically, it handles counting how many API command you have run and publishing every 80, setting the session details after every publish, and publishing before logging out. Using it, you never need to explicitly publish. You write API commands, and they just work. I use it to add a predictable set of objects, policies, rules, and so on to new management VMs or after rebuilding my personal standalone.

#!/usr/bin/env bash sessionName="Initial Build" sessionDescription="Building my initial config for a new lab management." publishEvery=80 changeCount=1 publishBatch=1 function mgmtCmd { commandToRun="" for element in "${@}"; do if [[ "$element" =~ \ ]]; then commandToRun="${commandToRun} \"${element}\"" else commandToRun="${commandToRun} ${element}" fi done echo "${commandToRun}" | xargs mgmt_cli -s session.txt if [ $? -eq 0 ]; then echo "Success ${publishBatch}.${changeCount}" ((changeCount+=1)) else echo "Failed: ${commandToRun}" fi if [ ${changeCount} -gt ${publishEvery} ]; then echo "Publishing..." publish setupSession ((publishBatch+=1)) fi } function publish { mgmt_cli -s session.txt publish } function setupSession { changeCount=1 mgmt_cli -s session.txt set session new-name "${sessionName}" description "${sessionDescription}" > /dev/null } function login { mgmt_cli -r true login > session.txt setupSession } function logout { publish mgmt_cli -s session.txt logout > /dev/null rm session.txt } login mgmtCmd add dns-domain name ".github.com" is-sub-domain false mgmtCmd add network name "RFC 10/8" subnet4 "10.0.0.0" mask-length4 8 broadcast allow mgmtCmd add tag name "Development" ... ... ... mgmtCmd add package name "InstalledNowhere" access true installedNowhereUuid=$(mgmt_cli -f json -s session.txt show package name "InstalledNowhere" details-level uid | jq '.uid') mgmtCmd set generic-object uid "${installedNowhereUuid}" installationTargets "SPECIFIC_GATEWAYS" logout

The mgmtCmd function doesn't return anything, so if you need to get output of a command (such as to find the UUID of an object you just created), you will need to call mgmt_cli directly as you can see in the last few lines.

Re: BASH Framework for Management API Commands

Danny — Sat, 21 Jan 2023 16:32:04 GMT

Thx for sharing!

Re: BASH Framework for Management API Commands

Bob_Zimmerman — Tue, 05 Dec 2023 17:03:53 GMT

I made a few internal improvements.

Added support for connecting to the management API on non-default ports. This helps when using the framework not for initial builds, but for building lots of things in an existing management.
Switched from a static "session.txt" file to store the session cookie to a temp file provided by mktemp. This way, each run of the script will get a different file. You could potentially run multiple instances at the same time now. Again, this is mostly useful for existing management servers which multiple admins might be modifying at once.
Added an argument to login to allow it to support logging in to a management domain. On a SmartCenter, this can be used to log in to System Data to change API settings, for example. It also allows the script to be used to build an MDS.

#!/usr/bin/env bash sessionName="Initial Build" sessionDescription="Building my initial config for a new lab management." publishEvery=80 changeCount=1 publishBatch=1 apiPort=$(api status | grep 'APACHE Gaia Port' | awk '{print $NF}') sessionCookie=$(mktemp) function mgmtCmd { commandToRun="" for element in "${@}"; do if [[ "$element" =~ \ ]]; then commandToRun="${commandToRun} \"${element}\"" else commandToRun="${commandToRun} ${element}" fi done echo "${commandToRun}" | xargs mgmt_cli --port "${apiPort}" -s "${sessionCookie}" if [ $? -eq 0 ]; then echo "Success ${publishBatch}.${changeCount}" ((changeCount+=1)) else echo "Failed: ${commandToRun}" fi if [ ${changeCount} -gt ${publishEvery} ]; then echo "Publishing..." publish setupSession changeCount=1 ((publishBatch+=1)) fi } function publish { mgmt_cli --port "${apiPort}" -s "${sessionCookie}" publish } function setupSession { mgmt_cli --port "${apiPort}" -s "${sessionCookie}" set session new-name "${sessionName}" description "${sessionDescription}" > /dev/null } function login { mgmt_cli --port "${apiPort}" -d "${1}" -r true login > "${sessionCookie}" setupSession } function logout { publish mgmt_cli --port "${apiPort}" -s "${sessionCookie}" logout > /dev/null rm "${sessionCookie}" } login "System Data" mgmtCmd set api-settings accepted-api-calls-from "all ip addresses that can be used for gui clients" logout api restart login mgmtCmd add dns-domain name ".github.com" is-sub-domain false mgmtCmd add network name "RFC 10/8" subnet4 "10.0.0.0" mask-length4 8 broadcast allow mgmtCmd add tag name "Development" ... ... ... mgmtCmd add package name "InstalledNowhere" access true installedNowhereUuid=$(mgmt_cli --port "${apiPort}" -f json -s "${sessionCookie}" show package name "InstalledNowhere" details-level uid | jq '.uid') mgmtCmd set generic-object uid "${installedNowhereUuid}" installationTargets "SPECIFIC_GATEWAYS" logout

Re: BASH Framework for Management API Commands

Bob_Zimmerman — Mon, 27 Jul 2026 20:42:38 GMT

I just found out this code is in the CCAS labs! Some notice would have been nice, but that's pretty cool.

Re: BASH Framework for Management API Commands

Don_Paterson — Mon, 27 Jul 2026 23:12:11 GMT

And I just now found out (from seeing your post for the first time) where the script came from that is used in the course I have taught a number of times.

You should be given credit and it should also be explained better in the CCAS book.

I had to write a description of what the script actually does and then wondered why it got slotted into the labs where it did.

I have a slightly updated version that prompts for credentials to avoid r true for all the reasons to not use r true in the labs.

Great work. Thanks.

Re: BASH Framework for Management API Commands

Danny — Tue, 28 Jul 2026 17:42:38 GMT

When my tools and scripts were used in the courseware, I received a notice and this contributor badge.

Re: BASH Framework for Management API Commands

Bob_Zimmerman — Tue, 28 Jul 2026 15:39:52 GMT

The reception here seemed kind of tepid, so I've been focused on other things. I've hit a few bugs related to making API calls in loops (e.g, to deal with the output of /show-unused-objects for some automated cleanup). That can allow more than 80 changes in a session, and can make it hard to tell what is being done in any individual step. Now that I know it's more broadly used, I'll try to make some time to update it.

I still use it extensively for initial builds in labs, of course. Any time I want to try a new version on my lab management, I install clean and populate my objects with a script built using this framework.