Functionality - API vs. SmartConsole

[Timothy_Hall]

When teaching the Check Point Certified Automation Specialist (CCAS) class, a common question I get is what types of Management operations cannot be performed through the API and must be performed through the SmartConsole GUI instead.  I have a bit of an unofficial list but would like to compile an authoritative list with the CheckMates community; various API limitations have been discussed in prior threads like this.  Some ground rules:

1) Only releases that are GA like R80.30 and earlier may be discussed, so if an API limitation is resolved in an upcoming release like R80.40 that doesn't count

2) dbedit is not the API and doesn't really count, but feel free to discuss workarounds for the various limitations

3) This list of limitations is for the Management API, not the Threat Prevention API, Identity Awareness API, etc.

4) Features available through the API that are not available in the SmartConsole GUI (like specific Hit Count history) should not be included (that could be a separate post)

So without further ado, here is the list of Management operations that cannot be performed via the Management API and must be performed through a GUI instead, please feel free to add items to this list or provide corrections:

1) Manipulation of gateway cluster objects

2) Geo Policy

3) HTTPS Inspection

4) Mobile Access Blade

5) Anti-spam & Mail Blade

6) DLP Blade (not Content Awareness)

7) SmartEvent Event Policy Tuning (performed in a separate GUI from SmartConsole)

😎 SmartUpdate License Manipulation (performed in a separate GUI from SmartConsole)

9) QoS Blade/Policies (not APCL/URLF Limits)

10) GUIDBedit operations (performed in a separate GUI from SmartConsole)

Edit: 11) Performing an Install Database operation for an SMS/MDS

Thanks everyone!

[PhoneBoy]

It's a good starting list.
There are a few others that don't have official APIs but may be (partially) accomplished using generic-object APIs.

1. Creating interoperable VPN objects (can partially be done with generic-object APIs)
2. LDAP objects
3. User@Host objects
4. Legacy UFP/CVP objects (which are deprecated in R80.x anyway)
5. Endpoint policies

[Paul_Nokel]

Hi,

this list can be really useful and help planning automation tasks.

The point that I miss the most:

- Almost anything related to IPS. Including excpetions.

Best regards,

Paul

[JozkoMrkvicka]

Not really SmartConsole related (even not for Managements), but following APIs would be also really great:

1. Complete FTW (First Time Wizard) via API
2. Add/Remove/Modify licenses via API
3. Configure RADIUS, NTP, SYSLOG, DNS, routes, VLANs, DHCP via API (partially included in Ender - Gaia REST API )

[PhoneBoy]

IPS is part of the overall Threat Prevention policy in R80.x, which definitely has API support.

[PhoneBoy]

We can potentially remove Cluster Objects and HTTPS Inspection from this list in R80.40, based on the current EA feature set.
Geo Policy should be done using Updatable Objects in R80.20+, which is inherently more flexible than the traditional Geo Policy.
Mobile Access Blade is partially supported by API in R80.x if you use the unified policy approach.

[FedericoMeiners]

Associate interfaces to security zones? I couldn't find it neither in mgmt_cli or vsx_util

[PhoneBoy]

This is definitely doable using set simple-gateway.
It's one of the parameters you pass when modifying an interface, e.g. security-zone-settings
If you have a specific question about this, I highly recommend starting a new thread.

[Francesco-P]

Hi,

just to add the useful "Replace feature" available under "where used" in SmartConsole and not in api call.
Btw, this action is possible with some script