topic Re: VPN tunnel Reset via API in API / CLI Discussion

VPN tunnel Reset via API

Kim_Moberg — Fri, 27 Jul 2018 13:25:36 GMT

I was thinking if there have been any considerations of inplementing any was to reset vpn tunnel via th mgmt API interface?

Heiko Ankenbrand did provide a great hint to to use vpn tu via commandline.

https://community.checkpoint.com/docs/DOC-3021-show-vpn-routing-on-cli

Commands are:

vpn tu del ipsec all

vpn tu del ipsec ip-addr

vpn tu del ipsec ip-addr username

vpn tu del all

vpn tu del ip-addr

vpn tu del ip-addr username

I was thinking since smart monitor can do this from the manager why not also being able to do so from the mgmt API?

We have a lot if ipsec vpn which on Remote site have a lte router in front of a Cisco router. This LTE router being reset daily at midnight but due to missing dead Peer detection old sessions not being reset after reboot of the LTE router.

This cause sometimes we manually need to reset vpn tunnels.

This we would like to deligate to users who are not firewall experts, and do not want to allow them smart monitor or expert access.

Therefore we would like to build a portal where they can login and check connection status’s and reset vpn id wanted.

Would that we easy to implement and easy to solve?

Thanks

Best regards

Kim

Re: VPN tunnel Reset via API

Robert_Decker — Fri, 27 Jul 2018 13:38:39 GMT

Tomer Sole‌, we should add this to API future developments list, per product owner.

Robert.

Re: VPN tunnel Reset via API

PhoneBoy — Sun, 29 Jul 2018 02:56:53 GMT

This might be useful for the gateway API currently under development (i.e. where you will be able to query the gateway directly with REST API).

Alexander Kim‌

Re: VPN tunnel Reset via API

Alexander_Kim — Sun, 29 Jul 2018 05:38:01 GMT

Sounds nice. I will talk with VPN guys, offer them the i/s.

There could be more useful commands, the whole "vpn" binary.

Thanks

Re: VPN tunnel Reset via API

Tomer_Sole — Sun, 29 Jul 2018 06:34:41 GMT

you can do that today using run-script API.

Check Point - Management API reference

Re: VPN tunnel Reset via API

Kim_Moberg — Sun, 29 Jul 2018 06:48:24 GMT

Thanks Tom

But then I will need to use those scripts to parse via mgmt smartconsole.

If I would my own website for internal use I will have to:

Create a ssh to active cluster node
Login as expert
Run-script with vpn tu del <peer address>
Sign out expert mode
Clos ssh session

This have to be done either vi asp .net or php and before that I would need to find the peer that might have an issue.

What I was thinking talking from smart monitor.

You got some kind of ping running showing the connection is open.

And you have the name of the vpn community as well as the peer address

If it was a API entry in Json I would being able to request these informations in a couple of requests.

Re: VPN tunnel Reset via API

Tomer_Sole — Sun, 29 Jul 2018 07:28:31 GMT

That's true. With R80.10 Management API you can only send all VPN calls to one place (the Management) rather than login to every gateway.

Re: VPN tunnel Reset via API

Kim_Moberg — Fri, 18 Jan 2019 21:01:45 GMT

It is fantastic to see Gaia API is now in GA.

I have already checked it out and I see a great potential of providing API to Secure gateways.

What I have looking for a long time is to include VPN shell functionality into the Gaia API.

Did not see the features available yet but have been in dialog with Alexander Kim if it could be included in a feature roadmap release and that was possible.

This is my idea basically.

To include the CLISH VPN shell and tu commands into the API. I have been freely translating how a possible API for this method fundation could look like.

https://{{ip}}/gaia_api/vpn/show-tunnels-ike (features show all peers, or peers ip)

https://{{ip}}/gaia_api/vpn/show-tunnels-IPsec (features show all peers, or peers ip)

https://{{ip}}/gaia_api/vpn/delete-ipsec-tunnel-all

https://{{ip}}/gaia_api/vpn/delete-ipsec-tunnel-peer

https://{{ip}}/gaia_api/vpn/delete-ipsec-peer-username

https://{{ip}}/gaia_api/vpn/delete-all-tunnels

https://{{ip}}/gaia_api/vpn/delete-peer-username

Any order ideas?

Thanks

Kim

Re: VPN tunnel Reset via API

Claudio_Bolcato — Thu, 29 Sep 2022 06:56:53 GMT

Hi everyone, is there any update on this topic? My operation team would need a solution like that. I'm not happy to give them write access just for resetting tunnels.

Thanks in advance