About 6 months ago, CP gave us a script to run from Provider 1 to grab all gateways and their corresponding model/software version. However, it was a very inconsistent result. Meaning that, some (active) gateways came back with just host name and IP and then some came back with host name/IP/OS Version/model number.Anybody aware of a way to pull : Gateway Info that includes (Hostname/IP/OS-Version/Model)? I know you can export a list through network objects, but I just want active count for inventory. Any such method/script?

Hi guys, I am installing Ansible with CheckPoint module in my lab (on Ubuntu 16.04.01) according to the guide from: https://github.com/CheckPointSW/cpAnsible I installed the Ansible 2.0.0.2 from Ubuntu repository. I am getting following error.TASK [login] *******************************************************************task path: /home/yevgeniy/ansible/cpx_add_host.yml:4fatal: [127.0.0.1]: FAILED! => {"failed": true, "msg": "ERROR! error importing module in /usr/share/my_modules/check_point_mgmt/check_point_mgmt.py, expecting format like 'from ansible.module_utils.basic import *'"} The error comes from:yevgeniy@kubuntu-desktop:/usr/share/my_modules/check_point_mgmt$ pwd/usr/share/my_modules/check_point_mgmtyevgeniy@kubuntu-desktop:/usr/share/my_modules/check_point_mgmt$ ls -al-rw-r--r-- 1 root root 10115 Sep 13 17:31 check_point_mgmt.pycat check_point_mgmt.py#!/usr/bin/pythonimport astimport jsonimport sysfrom ansible.module_utils.basic import AnsibleModule… The file and object are exist:yevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$ pwd/usr/lib/python2.7/dist-packagesyevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$yevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$ cat ansible/module_utils/basic.py | grep AnsibleModuleclass AnsibleModule(object): Below is the configuration and playbook. I would very appreciate your feedback. /etc/ansible/hosts[localhost]127.0.0.1[localhost:vars]ansible_user=yevgeniyansible_ssh_pass=qwe123ansible_python_interpreter=/usr/bin/python2.7# Optional (variables detailing the Check Point's management server access):mgmt_server=192.168.168.50mgmt_user=adminmgmt_password=qwe123 /etc/ansible/ansible.cfg[defaults]#inventory = /etc/ansible/hostslibrary = /usr/share/my_modules/host_key_checking = False Playbookyevgeniy@kubuntu-desktop:~/ansible$ cat cpx_add_host.yml---- hosts: "localhost" tasks: - name: "login" check_point_mgmt: command: login parameters: username: "{{mgmt_user}}" password: "{{mgmt_password}}" management: "{{mgmt_server}}" fingerprint: "FA:5A:A6:AC:93:D0:BD:69:9E:E1:72:05:1D:73:24:70:29:17:37:C1" register: login_response - name: "add-host-cpx-host1" check_point_mgmt: command: add-host parameters: name: "cpx-host1" ip-address: "192.168.202.100" session-data: "{{login_response}}" - name: "publish" check_point_mgmt: command: publish session-data: "{{login_response}}" - name: "logout" check_point_mgmt: command: logout session-data: "{{login_response}}" yevgeniy@kubuntu-desktop:~/ansible$ sudo ansible-playbook cpx_add_host.yml -vvvvvUsing /etc/ansible/ansible.cfg as config fileLoaded callback default of type stdout, v2.01 plays in cpx_add_host.yml PLAY *************************************************************************** TASK [setup] *******************************************************************<127.0.0.1> ESTABLISH SSH CONNECTION FOR USER: yevgeniy<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set ssh_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r -tt 127.0.0.1 '( umask 22 && mkdir -p "$( echo $HOME/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131 )" && echo "$( echo $HOME/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131 )" )'<127.0.0.1> PUT /tmp/tmpJ04k4u TO /home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/setup<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set sftp_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 sftp -b - -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r '[127.0.0.1]'<127.0.0.1> ESTABLISH SSH CONNECTION FOR USER: yevgeniy<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set ssh_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r -tt 127.0.0.1 'LANG=de_DE.UTF-8 LC_ALL=de_DE.UTF-8 LC_MESSAGES=de_DE.UTF-8 /usr/bin/python2.7 /home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/setup; rm -rf "/home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/" > /dev/null 2>&1'ok: [127.0.0.1] TASK [login] *******************************************************************task path: /home/yevgeniy/ansible/cpx_add_host.yml:4fatal: [127.0.0.1]: FAILED! => {"failed": true, "msg": "ERROR! error importing module in /usr/share/my_modules/check_point_mgmt/check_point_mgmt.py, expecting format like 'from ansible.module_utils.basic import *'"} PLAY RECAP *********************************************************************127.0.0.1 : ok=1 changed=0 unreachable=0 failed=1 yevgeniy@kubuntu-desktop:~/ansible$ Mit freundlichen Grüßen / Best regards Yevgeniy Yeryomin | Professional Services Consultant Check Point Software Technologies | M +49 151 4401 9871 | * yyeryomin@checkpoint.comAdvanced Technical Account Manager | Learn More

Hi, I'm trying to solve this Ansible playbook issueIf my playbooks are in this directory /usr/lib/python2.7/site-packages/ansible/modules/extrasthe playbooks run fine. When using Tower, it puts them in its own folder which is /var/lib/aws/projects/<dynamic>/whatever.ymland I get the following message (both in tower and when I run locally like below) I have tried multiple things to try to straiten this out. Any suggestions?

Hello,I have a management server running R80.10, which has almost 20 devices connected and has hundreds of rules defined. I wanted to disable rules that are not in use currently via Web API using Python script. Please guide me if there is way to do the same.Please help me.

On 15th August 2017 we did a webinar with Ryan Darst‌ about the automation and orchestration capabilities you can achieve with the R80.10 API. Specifically, this session covered:Introduction to using the R80.10 APIs using a variety of tools from Postman to AnsibleTips on leveraging the API from both the R80.10 CLI and from the RESTful API to do simple tasks from adding objects and services to adding rulesAdditional use cases for using other features in the R80 API from policy verification to running scripts on gatewaysA demonstration of a complete Check Point cloud auto-scaling environment using Ansible and the R80.10 APIsThe content presented is below:Slides: How to use R80.10 API for Automation and Streamlined Security (PPT)‌Video: How to use R80.10 API for Automation and Streamlined Security (Video) Scripts: CheckMates_Aug15_Demos.zip‌Q&A:

I was trying to add a number of object this week, I had done some last week. Last week I added them to 1 domain and now I wanted to add them to another domain, what I did upfront was mdsenv <Domain> and started issuing the commands, this worked like a charm.Today however when I tried to add some objects to another domain, using the same way, first set the mdsenv to the correct domain, then started issuing the (copy paste) the mgmt_cli commands, the objects ended up in the domain that I used last week???I found out by going in the second domain and use the new network objects but were not there. Then when I issued the mgmt_cli show networks command, it showed me all the network objects from the other domain I worked on last week.Hmm, ok maybe I need to do a set domain name <domain> command first? Well in the expert mode with mgmt_cli, that did not work, unknown object.So ok lets try from clish and use the mgmt commands instead, as the first command used mgmt set domain name <Domain> and then issued the add network commands. they were accepted, no error messages. Going into Smartconsole, none of the networks I added are there, nor in the other domain nor in the Global domain.What am I doing wrong?

Hi,So, I wrote my own backup script for Security Management Server and I thought the proper place to put it in is /usr/local/sbin/Well, I was wrong. When I upgraded server from R80.10 to R80.20 my script was silently deleted.Where shall I place my scripts so that they are preserved between upgrades?

Hey,Has anyone installed mgmt_cli on Ubuntu (no Check Point installation on this server)? Which libraries etc. do I need to get it working?Thanks!

The nice thing with the R80.10 Cloud Demo option is that you no longer need a real Check Point license to test security management features. And the API is one of them.1. Get the server IP by clicking “copy server IP” 2. Get an administrator with a password that you know of, by creating one at “Permissions & Administrators” or by changing the password of one of the existing administrators. Publish your changes. Now you can test your tools by connecting to this server IP with the administrator username and password.

What is the permission required for API to create a gateway object?I have created a role using custom mode so I can remove the excessive privilege later, and I have assigned all the possible privilege with write permission. I am still getting run time error when creating a simple gateway object from ansible. It works find if the role is given full write permission. Error message below:fatal: [127.0.0.1]: FAILED! => {"changed": false, "failed": true, "msg": "Command 'add-simple-gateway {u'one-time-password': u'aaa12345', u'interfaces': [{u'ipv4-network-mask': u'255.255.255.0', u'anti-spoofing': u'true', u'ipv4-address': u'10.0.1.88', u'name': u'eth0', u'topology': u'External'}, {u'anti-spoofing': u'true', u'name': u'eth1', u'topology-settings': {u'ip-address-behind-this-interface': u'network defined by the interface ip and net mask'}, u'ipv4-network-mask': u'255.255.255.0', u'ipv4-address': u'172.16.1.88', u'topology': u'Internal'}], u'name': u'demo_gateway', u'ip-address': u'192.0.1.88', u'comments': u'added by Ansible'}' failed with error message: Runtime error: Error reading XMLStreamReader: Unexpected EOF in prolog at javax.xml.stream.SerializableLocation@c1137a34. All changes are discarded and the session is invalidated."}

Is there a Check Point tool to easily convert hexadecimal values to IP addresses on the CLI? I use the following lines in scripts: hexaddr=$(echo 12cd34ef)ipaddr=$(printf "%d." $(echo $hexaddr | sed 's/../0x& /g' | tr ' ' '\n' | tac) | sed 's/\.$/\n/')echo $ipaddr Is there an easier way? Regards Heiko Ankenbrand

I have mulitple policy packages that have a security layer and a application layer. The application layer appeared after importing from migrate import from R77, i do not want it. I would like to remove this layer from all these policy packages.The application layer has only 1 ruleAny -> Internet -> accept -> detailed log :accountingI thought i would just be able to delete the layer from the API. It deletes perfectly from the SmartConsole. I have trieddeleting the application access layermgmt_cli -r true -d Mgmt1 delete access-layer uid "12345678-abcd-4710-a798-12345609f989"code: "generic_err_object_deletion"message: "Object MyPolicy Application could not be deleted because it is referenced by other objects, run where-used command for details"I have verified that I have the correct id for the application layer, using show object uid.mgmt_cli -r true -d Mgmt1 where-used uid "12345678-abcd-4710-a798-12345609f989"code: "generic_err_object_not_found"message: "Requested object [12345678-805c-4710-a798-12345609f989] not found"where used doesnt work on this object, ok expected i think.I tried to delete the 1 rule from the application access layermgmt_cli -r true -d Mgmt1 delete access-rule layer "12345678-abcd-4710-a798-12345609f989" rule-number 1 --format json{ "code" : "generic_error", "message" : "Runtime error: Cannot delete the only child of the rulebase."}So , can i delete this using the API, what am i missing?

Hey all,I am looking for an easy way to query the cpview data in order to create some graphs (cpu, memory and other stats during last 30 days). Has anyone done this? Any insight would be great. Thanks

I'm working on a baseline for an inline policy to enable URL Filtering and Application control for a customer that has not used this before, I searched through the questions here but could not find a response that would give me the clue. I run into some issues, while most things work just fine, adding and filling groups and creating the Layer with all rules, I'm just hitting a few snags, like when I add a drop rule I would also like to show the default Block Page, however I can only add 1 action Item, how can you add more actions?The layer is added but unless I set it to shared the layer cannot be manually used as an inline layer. After the test I wanted to remove the layer again, it is not in use but delete layer is grayed out, in Manage Policies and Layers.

Prior to R80, there was a closed-source tool by Check Point called export_import_profile.Starting with R80:1. The back-end representation of profiles and protections has changed, so the tool is no longer supported.2. The open API enable any customer to make their own export and import operations.Step 1: On the source machine, export the specific Threat Prevention ProfileThe show threat-profile command returns a structure of the profile's settings.Example:show threat-profile name MyOrganization details-level full uid: "fa1aa324-a8cc-4dbd-bc04-f31fdb8abf61"name: "MyOrganization "type: "threat-profile"domain: uid: "a0bbbc99-adef-4ef8-bb6d-defdefdefdef" name: "Check Point Data" domain-type: "data domain"active-protections-performance-impact: "medium"active-protections-severity: "Medium or above"confidence-level-low: "Inactive"confidence-level-medium: "Prevent"confidence-level-high: "Prevent"ips: trueips-settings: newly-updated-protections: "staging" exclude-protection-with-performance-impact: false exclude-protection-with-severity: falsethreat-emulation: trueanti-virus: trueanti-bot: trueStep 2: On the source machine, export IPS Protections which had their action override for this specific Threat Prevention ProfileThis part is a little tricky - you have to go over all protections, and only pick the ones that have a different action for your profile. The show threat-protections command returns the protections. There is no way to get all the IPS Protections as one response, since that would make the output so big it will fail to return. Therefore we have to use the "offset" parameter to advance and get 50 protections every time. In the example below, the first protection just happened to have an override action for the "MyOrganization" profile. The second protection did not have an override action for the "MyOrganization" profile.Example:show threat-protections offset 0 details-level fullprotections: - uid: "8027f5c8-1bac-cf49-99a3-59a89a35cdb6" name: "3Com Network Supervisor Directory Traversal" type: "threat-protection" domain: uid: "41e821a0-3720-11e3-aa6e-0800200c9fde" name: "SMC User" domain-type: "domain" severity: "High" confidence-level: "Medium" performance-impact: "Low" release-date: "20091124" update-date: "20091124" profiles: - name: "Basic" uid: "eb39a60d-c454-49f5-a28c-a89aa5bd2e09" default: action: "Inactive" track: "log" capture-packets: false final: action: "Inactive" track: "log" capture-packets: false - name: "Strict" uid: "caf8b711-d762-4c1e-82d5-6af2549b2869" default: action: "Prevent" track: "log" capture-packets: false final: action: "Prevent" track: "log" capture-packets: false - name: "MyOrganization" uid: "fa1aa324-a8cc-4dbd-bc04-f31fdb8abf61" default: track: "log" capture-packets: false override: action: "Prevent" track: "log" capture-packets: false final: action: "Prevent" track: "log" capture-packets: false comments: "" follow-up: false ipsAdditionalProperties: ... name: "3Com TFTP Server Transporting Mode Remote Buffer Overflow" type: "threat-protection" - name: "MyOrganization" uid: "fa1aa324-a8cc-4dbd-bc04-f31fdb8abf61" default: action: "Inactive" track: "log" capture-packets: false final: action: "Inactive" track: "log" capture-packets: false...Step 3: On the target machine, create the new profile.The add threat-profile command creates a new Threat Prevention Profile.You have to convert the output from step 1 to a command-line with the values.Example:add threat-profile name MyOrganization active-protections-performance-impact "medium" active-protections-severity "Medium or above" confidence-level-low "Inactive" confidence-level-medium "Prevent" confidence-level-high "Prevent" ips true ips-settings.newly-updated-protections "staging" ips-settings.exclude-protection-with-performance-impact false ips-settings.exclude-protection-with-severity false threat-emulation true anti-virus true anti-bot true Step 4: On the target machine, set protection actions for the specific protections that were exported at step 2.The set threat-protection command lets you change the action of the protection for a given profile.Example:set threat-protection name "3Com Network Supervisor Directory Traversal" overrides.1.profile MyOrganization overrides.1.action Prevent

Take control of new Threat Prevention APIs powered by the largest Threat Cloud in the industry: URL Reputation – for a domain/URL returns the classification and risk in accessing the resource File Reputation – for a file digest (md5/sha1/sha256/sha512) returns the risk in downloading the file without the need to scan it IP Reputation - for an IP address returns it’s classification and risk in accessing a resource hosted on it Mail Security – upload an email for scanning against malware and phishing attacks, based on award winning Sandblast engines All APIs are RESTful, simple to use and can be integrated as part of a SOAR application, home-made application and more! If you’re a Check Point customer interested in participating in the early availability stage drop me a mail at yoav@checkpoint.com

I’m glad to share our new API Reference portal . This site will be “one-stop-shop” for all CP APIs references. Currently we have added Management APIs and Gaia APIs, we are in progress of adding the rest of APIs (SandBlast , TP APIs etc.) Regards, Amiad.