topic Re: SMB Export Access Policy to file in Spark Firewall (SMB)

SMB Export Access Policy to file

Michel_de_Boer — Tue, 17 Aug 2021 14:38:47 GMT

Hi all, we have a lot of SMB appliances in SMP and most of all are 1500's or above. So R80 embedded gaia.

Our goal is to export the Access Policy from the appliances and match them with a previous version if there were made any changes in the policy. First of all we need to export the policy to a file. In SMP I can run some show commands but an export or something will fail. I think those are gaia commands and not embedded gaia supported.

I've read and tried a lot of posts from others over here but those solutions are relevant to full blown gaia solutions.

Can somebody provide me a way how to achieve our goal?

Re: SMB Export Access Policy to file

G_W_Albrecht — Wed, 18 Aug 2021 06:47:03 GMT

There is an option from CLI. Log into Expert Mode and issue:

[Expert]# clish -A -i -c "show configuration" -v >> /var/log/config.txt

Now, backup and delete /var/log/config.txt (by CLI or WinSCP) - it will contain all settings including policy !

Re: SMB Export Access Policy to file

Michel_de_Boer — Tue, 17 Aug 2021 15:26:04 GMT

Thanks for your reply, I've changed your command to:

clish -A -i -c "show access-rules type incoming-internal-and-vpn" -v >> /var/log/acl_incoming.txt
clish -A -i -c "show access-rules type outgoing" -v >> /var/log/acl_outgoing.txt

This output is in base what we are looking for.

Is there a way to upload them directly to a sftp server like we do with the backups?

Re: SMB Export Access Policy to file

Art_Zalenekas — Tue, 17 Aug 2021 15:48:49 GMT

Why not cook an Ansible playbook to do it all and download the configs to the right place!? Run it on weekly (whatever your SOP is) basis, and don't have so many custom scripts.

Re: SMB Export Access Policy to file

G_W_Albrecht — Wed, 18 Aug 2021 07:01:14 GMT

My first idea was to point out these in the CLI Guide to you 8). But then i thought you are better off with one command and a procedure. Good if these two outputs are enough to achieve your goal !

Usually, SCP is used for file transfer.