topic Re: what component is the destination with API command? in Spark Firewall (SMB)

what component is the destination with API command?

roby198 — Sun, 22 Sep 2024 19:05:43 GMT

Hi, I have an engine CheckPoint 1600 FW (Quantum Spark) manged by a CheckPoint cloud management.

I have to push some policy rules via API and I didn't understand if i can send the APIs to the firewall engine directly or i have to send them to the I management only.

Then seems i need to configure a user that will manage the API , what happen is i have the 2FA activated?

Thank you

Roby

Re: what component is the destination with API command?

Tal_Paz-Fridman — Mon, 23 Sep 2024 05:37:01 GMT

Management API can be run from several locations and using various tools. See the options at the top of each command:

mgmt_cli tool
Web Services
SmartConsole CLI
Gaia CLI

For install policy run command on the Management Server and list the Security Gateways that are the target:

https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/install-policy~v1.9.1%20

For example:

mgmt_cli install-policy policy-package "standard" access true threat-prevention true targets.1 "corporate-gateway"  --format json

Re: what component is the destination with API command?

PhoneBoy — Mon, 23 Sep 2024 13:53:36 GMT

The question is what is the endpoint he needs to connect to in order to manage via API.
That…would be the central management (in this case, Smart-1 Cloud).
API keys can be configured for usage via API.

Re: what component is the destination with API command?

roby198 — Mon, 23 Sep 2024 16:43:53 GMT

Yes exactly the question arises from the fact that I have to inject some rules via API and I don't understand if I have to send them to the management or directly to the perimeter firewall engine.
If I understood PhoneBoy's answer I have to send the API commands to the smart-1 cloud management and since for the API I have to specify a user account on the management how can it validate with username and password if I have 2FA turned on?
Thanks and sorry if I say some inaccuracies

Roby

Re: what component is the destination with API command?

PhoneBoy — Mon, 23 Sep 2024 19:07:43 GMT

MFA is not appropriate for programmatic access.
Create a specific user with API Keys as the authentication method: