API / CLI Discussion and Samples

The Best of
CheckMates!

CHECK OUT THE WINNERS

CheckMates Nuggets
Security Effectiveness

WATCH NOW

CheckMates GO
Episode #05

Listen Now!

The CheckMates
Challenge

JOIN NOW!

Create a Post

RECENT POSTS

MOST POPULAR

FEATURED POSTS

inside

192302 12 10

Powershell script to automate the creation of required Office 365 IP addresses or URLs in a Checkpoint management server

Hi,Here is a Powershell script that will automate the creation of all Office 365 IP addresses and URLs in a management server R80+ :*** UPDATE ***Here is an improved version of the script : Create-O365CheckpointObjects.ps1It depends on the ConvertFrom-O365AddressesXMLFile module (https://github.com/it-praktyk/Conver...dressesXMLFile). So you need to install it first.Here is the help :NOM Create-O365CheckpointObjects.ps1RÉSUMÉ Create the required objects in a Checkpoint R80+ management server to allow Office 365 trafficSYNTAXE Create-O365CheckpointObjects.ps1 [-Server] <String> [[-Port] <Int32>] [[-DomainName] <String>] [[-Service] <String>] [[-Prefix] <String>] [[-Category] <String>] [-Type] <String> [<CommonParameters>]DESCRIPTION This script will connect to https://support.content.office.net/en-us/static/O365IPAddresses.xml and download an XML file containing the required objects to allow Office 365 traffic to pass. It will then create the objects (IPv4, IPv6 addresses or URLs) into the Checkpoint management server using the R80+ API, according to the selected parameters. It depends on the ConvertFrom-O365AddressesXMLFile module (https://github.com/it-praktyk/Convert-Office365NetworksData/tree/master/ConvertFrom-O365AddressesXMLFile).PARAMÈTRES -Server <String> The mandatory Checkpoint management server hostname or IP address -Port <Int32> The Checkpoint R80 API port By default, 443 will be used -DomainName <String> -Service <String> An optional Office 365 to filter on (among "WAC","Sway","Planner","Yammer","OfficeMobile", "ProPlus", "RCA","OneNote","OfficeiPad","EXO","SPO","Office365Video","LYO","Identity","CRLs","o365" and "EOP" If not specified, all Office 365 services objects will be created -Prefix <String> A prefix for the Office 365 objects in the Checkpoint management server By default, "O365" will be used -Category <String> The primary category for the Office 365 application objects in the Checkpoint management server By default, "Microsoft & Office365 Services" will be used -Type <String> A mandatory object type to filter on (among "IPv4","IPv6","URL") <CommonParameters> Cette applet de commande prend en charge les paramètres courants*: Verbose, Debug, ErrorAction, ErrorVariable, WarningAction, WarningVariable, OutBuffer, PipelineVariable et OutVariable. Pour plus d’informations, voir about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216). -------------------------- EXEMPLE 1 -------------------------- PS C:\>Create-O365CheckpointObjects -Server cpserver -Type IPv4 Description: Will create the IPv4 objects for all the Office 365 apps in a Checkpoint management server named "cpserver" -------------------------- EXEMPLE 2 -------------------------- PS C:\>Create-O365CheckpointObjects -Server cpserver -Service LYO -Type IPv6 -Verbose Description: Will create the IPv6 network objects for Skype for Business in a Checkpoint management server named "cpserver" -------------------------- EXEMPLE 3 -------------------------- PS C:\>Create-O365CheckpointObjects -Server cpserver -Service EOP -Type URL -Category "Exchange" Description: Will create an application object for Exchange Online, with the required URLs, and a primary category set to "Exchange"REMARQUES Pour consulter les exemples, tapez: "get-help Create-O365CheckpointObjects.ps1 -examples". Pour plus d'informations, tapez: "get-help Create-O365CheckpointObjects.ps1 -detailed". Pour obtenir des informations techniques, tapez: "get-help Create-O365CheckpointObjects.ps1 -full".‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

inside

101499 44 10

Security Gateway Inventory

About 6 months ago, CP gave us a script to run from Provider 1 to grab all gateways and their corresponding model/software version. However, it was a very inconsistent result. Meaning that, some (active) gateways came back with just host name and IP and then some came back with host name/IP/OS Version/model number.Anybody aware of a way to pull : Gateway Info that includes (Hostname/IP/OS-Version/Model)? I know you can export a list through network objects, but I just want active count for inventory. Any such method/script?

inside

52299 4 3

cpAnsible installation on Ubuntu 16.04

Hi guys, I am installing Ansible with CheckPoint module in my lab (on Ubuntu 16.04.01) according to the guide from: https://github.com/CheckPointSW/cpAnsible I installed the Ansible 2.0.0.2 from Ubuntu repository. I am getting following error.TASK [login] *******************************************************************task path: /home/yevgeniy/ansible/cpx_add_host.yml:4fatal: [127.0.0.1]: FAILED! => {"failed": true, "msg": "ERROR! error importing module in /usr/share/my_modules/check_point_mgmt/check_point_mgmt.py, expecting format like 'from ansible.module_utils.basic import *'"} The error comes from:yevgeniy@kubuntu-desktop:/usr/share/my_modules/check_point_mgmt$ pwd/usr/share/my_modules/check_point_mgmtyevgeniy@kubuntu-desktop:/usr/share/my_modules/check_point_mgmt$ ls -al-rw-r--r-- 1 root root 10115 Sep 13 17:31 check_point_mgmt.pycat check_point_mgmt.py#!/usr/bin/pythonimport astimport jsonimport sysfrom ansible.module_utils.basic import AnsibleModule… The file and object are exist:yevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$ pwd/usr/lib/python2.7/dist-packagesyevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$yevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$ cat ansible/module_utils/basic.py | grep AnsibleModuleclass AnsibleModule(object): Below is the configuration and playbook. I would very appreciate your feedback. /etc/ansible/hosts[localhost]127.0.0.1[localhost:vars]ansible_user=yevgeniyansible_ssh_pass=qwe123ansible_python_interpreter=/usr/bin/python2.7# Optional (variables detailing the Check Point's management server access):mgmt_server=192.168.168.50mgmt_user=adminmgmt_password=qwe123 /etc/ansible/ansible.cfg[defaults]#inventory = /etc/ansible/hostslibrary = /usr/share/my_modules/host_key_checking = False Playbookyevgeniy@kubuntu-desktop:~/ansible$ cat cpx_add_host.yml---- hosts: "localhost" tasks: - name: "login" check_point_mgmt: command: login parameters: username: "{{mgmt_user}}" password: "{{mgmt_password}}" management: "{{mgmt_server}}" fingerprint: "FA:5A:A6:AC:93:D0:BD:69:9E:E1:72:05:1D:73:24:70:29:17:37:C1" register: login_response - name: "add-host-cpx-host1" check_point_mgmt: command: add-host parameters: name: "cpx-host1" ip-address: "192.168.202.100" session-data: "{{login_response}}" - name: "publish" check_point_mgmt: command: publish session-data: "{{login_response}}" - name: "logout" check_point_mgmt: command: logout session-data: "{{login_response}}" yevgeniy@kubuntu-desktop:~/ansible$ sudo ansible-playbook cpx_add_host.yml -vvvvvUsing /etc/ansible/ansible.cfg as config fileLoaded callback default of type stdout, v2.01 plays in cpx_add_host.yml PLAY *************************************************************************** TASK [setup] *******************************************************************<127.0.0.1> ESTABLISH SSH CONNECTION FOR USER: yevgeniy<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set ssh_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r -tt 127.0.0.1 '( umask 22 && mkdir -p "$( echo $HOME/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131 )" && echo "$( echo $HOME/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131 )" )'<127.0.0.1> PUT /tmp/tmpJ04k4u TO /home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/setup<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set sftp_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 sftp -b - -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r '[127.0.0.1]'<127.0.0.1> ESTABLISH SSH CONNECTION FOR USER: yevgeniy<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set ssh_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r -tt 127.0.0.1 'LANG=de_DE.UTF-8 LC_ALL=de_DE.UTF-8 LC_MESSAGES=de_DE.UTF-8 /usr/bin/python2.7 /home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/setup; rm -rf "/home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/" > /dev/null 2>&1'ok: [127.0.0.1] TASK [login] *******************************************************************task path: /home/yevgeniy/ansible/cpx_add_host.yml:4fatal: [127.0.0.1]: FAILED! => {"failed": true, "msg": "ERROR! error importing module in /usr/share/my_modules/check_point_mgmt/check_point_mgmt.py, expecting format like 'from ansible.module_utils.basic import *'"} PLAY RECAP *********************************************************************127.0.0.1 : ok=1 changed=0 unreachable=0 failed=1 yevgeniy@kubuntu-desktop:~/ansible$ Mit freundlichen Grüßen / Best regards Yevgeniy Yeryomin | Professional Services Consultant Check Point Software Technologies | M +49 151 4401 9871 | * yyeryomin@checkpoint.comAdvanced Technical Account Manager | Learn More

inside

48901 14 3

Disable a rule on R80.10 using Python Web API

Hello,I have a management server running R80.10, which has almost 20 devices connected and has hundreds of rules defined. I wanted to disable rules that are not in use currently via Web API using Python script. Please guide me if there is way to do the same.Please help me.

inside

48100 7

Ansible playbooks wont run outside of specific directory

Hi, I'm trying to solve this Ansible playbook issueIf my playbooks are in this directory /usr/lib/python2.7/site-packages/ansible/modules/extrasthe playbooks run fine. When using Tower, it puts them in its own folder which is /var/lib/aws/projects/<dynamic>/whatever.ymland I get the following message (both in tower and when I run locally like below) I have tried multiple things to try to straiten this out. Any suggestions?

inside

43700 14 31

Leveraging the R80.10 API to Automate and Streamline Security Operations

On 15th August 2017 we did a webinar with Ryan Darst‌ about the automation and orchestration capabilities you can achieve with the R80.10 API. Specifically, this session covered:Introduction to using the R80.10 APIs using a variety of tools from Postman to AnsibleTips on leveraging the API from both the R80.10 CLI and from the RESTful API to do simple tasks from adding objects and services to adding rulesAdditional use cases for using other features in the R80 API from policy verification to running scripts on gatewaysA demonstration of a complete Check Point cloud auto-scaling environment using Ansible and the R80.10 APIsThe content presented is below:Slides: How to use R80.10 API for Automation and Streamlined Security (PPT)‌Video: How to use R80.10 API for Automation and Streamlined Security (Video) Scripts: CheckMates_Aug15_Demos.zip‌Q&A: https://community.checkpoint.com/docs/DOC-2181?sr=search&searchId=a87f1f36-8fe9-4b5a-ac48-837a0d545793&searchIndex=1

inside

36900 5

multidomain and mgmt_cli

I was trying to add a number of object this week, I had done some last week. Last week I added them to 1 domain and now I wanted to add them to another domain, what I did upfront was mdsenv <Domain> and started issuing the commands, this worked like a charm.Today however when I tried to add some objects to another domain, using the same way, first set the mdsenv to the correct domain, then started issuing the (copy paste) the mgmt_cli commands, the objects ended up in the domain that I used last week???I found out by going in the second domain and use the new network objects but were not there. Then when I issued the mgmt_cli show networks command, it showed me all the network objects from the other domain I worked on last week.Hmm, ok maybe I need to do a set domain name <domain> command first? Well in the expert mode with mgmt_cli, that did not work, unknown object.So ok lets try from clish and use the mgmt commands instead, as the first command used mgmt set domain name <Domain> and then issued the add network commands. they were accepted, no error messages. Going into Smartconsole, none of the networks I added are there, nor in the other domain nor in the Global domain.What am I doing wrong?

inside

35700 14 4

Proper place to put custom scripts

Hi,So, I wrote my own backup script for Security Management Server and I thought the proper place to put it in is /usr/local/sbin/Well, I was wrong. When I upgraded server from R80.10 to R80.20 my script was silently deleted.Where shall I place my scripts so that they are preserved between upgrades?

inside

35100 19 1

mgmt_cli on Ubuntu

Hey,Has anyone installed mgmt_cli on Ubuntu (no Check Point installation on this server)? Which libraries etc. do I need to get it working?Thanks!

inside

34799 10 8

How to test the Management API with the Cloud Demo

The nice thing with the R80.10 Cloud Demo option is that you no longer need a real Check Point license to test security management features. And the API is one of them.1. Get the server IP by clicking “copy server IP” 2. Get an administrator with a password that you know of, by creating one at “Permissions & Administrators” or by changing the password of one of the existing administrators. Publish your changes. Now you can test your tools by connecting to this server IP with the administrator username and password.

inside

33100 262 60

Python tool for exporting/importing a policy package or parts of it

Overview ExportImportPolicyPackage tool enables you to export a policy package from a R80.x management database to a .tar.gz file, which can then be imported into any other R80.x management database. This tool can be used for backups, database transfers, testing, and more. In the case you are exporting a policy package from a CMA, please verify that a global policy was NOT assigned to that CMA.The tool doesn't support exporting a policy with global policy assigned! Description This tool enables you to export a policy package (Access Policy, Threat Policy or both) from a management server into a .tar.gz file. Notice There are some types of objects that the script might not be able to export.In such a case, an appropriate dummy object will be exported instead, and a message will be logged into the log files to notify you of this.In the Check Point SmartConsole you can easily replace each of these objects by searching "export_error" in the search field, see where each object is used, create the necessary object manually, then replace it. Instructions Download the latest version from our GitHub repository: https://github.com/CheckPointSW/ExportImportPolicyPackage First, make sure you have [2.7.9 <= Python <= 2.7.14] installed on the machine running the script.To export a package, run the import_export_package.py script. An interactive menu will guide you the rest of the way.Command line flags may also be set in order to skip some or all of the menu.A lot more details can of course be accessed with the [-h] option. This option also prints the current version of the tool. Current tool version is V3.0. Limitations This export/import script does not gather all data from a given management server/CMA.In general, it is limited by the R80.x Management APIs.Specifically, this means: CMAs with a Global Policy assigned cannot be exported Workaround: unassign the Global Policy prior to export Gateway/Cluster objects have to be recreated Placeholder objects will be created UserCheck messages have to be recreated Placeholder objects will be created The Internal Certificate Authority will not be copied. This means: Re-establishing SIC with the appropriate gateways Re-generating VPN certificates Manually recreating HTTPS Inspection and DLP Rules Other objects not currently readable/writable via the R80.x API will not be copied Tested on version R80.xReleases earlier than R80 lack the necessary API support and are not supported. Source Code Availability The source code is available through GitHub: https://github.com/CheckPointSW/ExportImportPolicyPackage FAQ Replies to this thread have locked.Please refer to the FAQ below before you create a new post with your question. When I run this tool, I get the message: APIResponse received a response which is not a valid JSON. This most likely means you haven't enabled the API server yet.See: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Enabling-web-api/m-p/32641 I get an error message related to server fingerprint Use the --unsafe option to ignore this error. Can this tool export more than one policy package at a time? Not currently, but you could call the tool in a script multiple times. NOTICE: By using this sample code you agree to terms and conditions in this Terms and Conditions

inside

32299 7 14

Check Point - HEX to IP Converter Tool?

Is there a Check Point tool to easily convert hexadecimal values to IP addresses on the CLI? I use the following lines in scripts: hexaddr=$(echo 12cd34ef)ipaddr=$(printf "%d." $(echo $hexaddr | sed 's/../0x& /g' | tr ' ' '\n' | tac) | sed 's/\.$/\n/')echo $ipaddr Is there an easier way? Regards Heiko Ankenbrand

inside

32263 6

Permission to create gateway object from API

What is the permission required for API to create a gateway object?I have created a role using custom mode so I can remove the excessive privilege later, and I have assigned all the possible privilege with write permission. I am still getting run time error when creating a simple gateway object from ansible. It works find if the role is given full write permission. Error message below:fatal: [127.0.0.1]: FAILED! => {"changed": false, "failed": true, "msg": "Command 'add-simple-gateway {u'one-time-password': u'aaa12345', u'interfaces': [{u'ipv4-network-mask': u'255.255.255.0', u'anti-spoofing': u'true', u'ipv4-address': u'10.0.1.88', u'name': u'eth0', u'topology': u'External'}, {u'anti-spoofing': u'true', u'name': u'eth1', u'topology-settings': {u'ip-address-behind-this-interface': u'network defined by the interface ip and net mask'}, u'ipv4-network-mask': u'255.255.255.0', u'ipv4-address': u'172.16.1.88', u'topology': u'Internal'}], u'name': u'demo_gateway', u'ip-address': u'192.0.1.88', u'comments': u'added by Ansible'}' failed with error message: Runtime error: Error reading XMLStreamReader: Unexpected EOF in prolog at javax.xml.stream.SerializableLocation@c1137a34. All changes are discarded and the session is invalidated."}

inside

31999 11 2

Script for multiple network/host/group object creation

Hello We recently started with R80 Management. One thing we would like to use is api scripts. we would like to create script that can read from csv/txt file and create network/host/group object. we have dynamic environment and new rules are requested all the time. this would reduce our time creating objects.Is this something possible to create and could we have some example?Thank you Ismar

inside

28999 4 1

problems deleting an application access-layer via API

I have mulitple policy packages that have a security layer and a application layer. The application layer appeared after importing from migrate import from R77, i do not want it. I would like to remove this layer from all these policy packages.The application layer has only 1 ruleAny -> Internet -> accept -> detailed log :accountingI thought i would just be able to delete the layer from the API. It deletes perfectly from the SmartConsole. I have trieddeleting the application access layermgmt_cli -r true -d Mgmt1 delete access-layer uid "12345678-abcd-4710-a798-12345609f989"code: "generic_err_object_deletion"message: "Object MyPolicy Application could not be deleted because it is referenced by other objects, run where-used command for details"I have verified that I have the correct id for the application layer, using show object uid.mgmt_cli -r true -d Mgmt1 where-used uid "12345678-abcd-4710-a798-12345609f989"code: "generic_err_object_not_found"message: "Requested object [12345678-805c-4710-a798-12345609f989] not found"where used doesnt work on this object, ok expected i think.I tried to delete the 1 rule from the application access layermgmt_cli -r true -d Mgmt1 delete access-rule layer "12345678-abcd-4710-a798-12345609f989" rule-number 1 --format json{ "code" : "generic_error", "message" : "Runtime error: Cannot delete the only child of the rulebase."}So , can i delete this using the API, what am i missing?

inside

12788 54 30

Show Package - Tool to visualize a R80 policy package over HTML pages

OverviewCheck Point ShowPolicyPackage tool visualizes the contents of a R80 security policy package (layers, rulebases, objects) over HTML pages.DescriptionThe tool allows the security policy as well as objects in the R80 objects database to be exported into a readable format. This exported information represents a snapshot of the database.The tool generates a compressed file (.tar.gz) containing the following files:• HTML files - The objects and rules presented as html files. The "index.html" acts as a starting point andlists all the available items to display.• JSON files - The objects and rules exported as multiple JSON files.• Log file (e.g. show_package-yyyy-mm-dd_HH-MM-ss.elg) - A log file containing debug information.Instructions This tool is hosted on GitHub repository for public use, containing a stand-alone executable Java JAR file (plug & play) and accompanied source code:https://github.com/CheckPointSW/ShowPolicyPackagePlease follow the usage instructions and examples on this site. It contains valuable information.Any questions, clarifications, improvements and feedback is welcome.P.S. This tool is also delivered along with R80 management server releases. But the GitHub repository is the most updated and maintained source!Tested on versionR80.10, API version 1.1Source Code AvailabilityThe source code is now public on GitHub repository as mentioned above.NOTICE: By using this sample code you agree to terms and conditions in this Terms and Conditions

inside

69 1

Installing SDK for ExportImport script

Hi, Please can someone help me out?I need to export my R80 policy to move onto another R80 policy.I am going to use the ExportImport packageI need install the SDK first and I think I am missing something simple.I have put both script packages in my home/admin folderTo install the SDK, I am running.../python2.7 /home/admin/cp_mgmt_api_python_sdk-master/opt/CPsuite-R80/fw1/Python/bin/python2.7: can't find '__main__' module in '/home/admin/cp_mgmt_api_python_sdk-master'I am getting lost - and trying to follow the instructions that are listed however it simply says to run this and not pip as pip isnt installed. I have done export PYTHONPATH=$PYTHONPATH:/home/admin/cp_mgmt_api_python_sdk-master But this just returned and did nothing which I presume is right?

inside

76 1

Edit interfaces of ClusterXL objects via generic object API, changes not visible in SmartConsole

Hello,I understand that there will be an API in R80.40 to manipulate interfaces of cluster objects. Unfortunately, I cannot wait for R80.40 in my project here. So I tried to add interfaces via the generic API described in https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/CloudGuard-Automated-firewall-Cluster-Deployment-with-auto/m-p/60667/highlight/trueRoughly, I added interfaces to the cluster nodes and to the cluster object like this:# set cluster and members with newly created interfacesmgmt_cli set generic-object uid $cluster_uid interfaces.add.create "com.checkpoint.objects.classes.dummy.CpmiClusterInterface" interfaces.add.owned-object.netmask "255.255.255.0" interfaces.add.owned-object.ipaddr $vip_ip interfaces.add.owned-object.memberNetwork.create "com.checkpoint.objects.classes.dummy.CpmiSubnet" interfaces.add.owned-object.memberNetwork.owned-object.netmask "255.255.255.0" interfaces.add.owned-object.memberNetwork.owned-object.ipaddr $cluster_net_ip interfaces.add.owned-object.officialname $interface_name interfaces.add.owned-object.monitoredByCluster true interfaces.add.owned-object.ifindex $if_index --format json --session-file login.txt > cluster_set_response.jsonI created interfaces manually in Smartconsole and checked what entries were created in the interface table of the member host and cluster objects with guidbedit. I was able to replicate these entries vai the gerneric object api. I also compared the output of get generic-object between the manual created ones and the ones created via the API.I actually can say, that my script is reproducing the manual action 1:1.BUT: There are 2 weired effects that I cannot explain and that block me from making further progress:1. When I create the interfaces via teh API and then go to Smartconsole, I won't find the new interfaces under "Network Management" of the firewall interface, while the new interfaces are definitely there in guidbedit or get generic object.2. When I create an interface manually in Smartconsole and then delete it via dbedit, the interfaces are still there in SmartConsole, while they are definitely gone in guidbedit and get generic-object.I understand that the widget for editing a firewall in R80 smartconsole is still using legacy code from R77, so is there some kind of sync to old style configuration files that needs to be done when the interfaces tables of a cluster is edited via the generic objects API?Any ideas how to solve that?

inside

168 3

checkpoint API

How to use checkpoint API to create IPv6 host address. Does any special configuration required to enable IPv6 API?

inside

164 4

API: install-on does not accept group targets

Hi,I have a customer who's moving from R77 to R80 and due to various reasons we have had to import objects and rules via mgmt_cli. However the API does not permit a group of firewalls as an install-on target; I had to create a dummy gateway object as a placeholder and then replace a number of rules with the group (which we had successfully imported via API).Would it be possible to make this feature work in next API? ThanksJamie

inside

265 3

Developing Web portal using API

Hey Checkmates,I need a help.! i am assigned with the task to develop a web portal which will be provided to my team members.That portal should contain features to add-host , delete-host, make network groups, Allow/deny traffic (in this case ,user-based policies) to a specific website, send only user traffic log (not system logs) on portal.. etc and a little more functionality. However i m not supposed to provide all the firewall details and functionality (such as adding/deleting subnet) to my team members. From my research i found out that it can be done using RESTful APIs via browser.Please suggest me how can i get started ?such asA) Programming language to put in use ?B) IDEs and Frameworks ??C) How to use Firewall APIs ?D) libraries of programming language?Also, for the development purpose initially i will be using Checkpoint firewall in Vmware (virtrual environment) .Thank you.

inside

21870 14 4

Manipulate Cluster Object with API

Hello guys,I am wondering if there is any way how to modify Cluster object using API tool. I know, that there are few commands to manipulate with "simple-gateway", but I would like to know if there is posibility to change something within Cluster Object, or even member(s) of Cluster. Lets say I want to add new interface (new VLAN) for cluster with 2 members in "Dashboard". Attaching screenshot what I would like to achieve.Of course I tried to use for example "show-simple-gateway" (see second attached screenshot) for Cluster, but I am getting following error:{ "code": "generic_error", "message": "Runtime error: com.checkpoint.objects.classes.dummy.CpmiGatewayCluster incompatible with com.checkpoint.objects.classes.dummy.CpmiGatewayCkp"}Is something like that posible ?Thank you for your answer.

inside

234 1

mgmt api failes to start

Hello Guys, I'm trying to start API on a machine I have and it fails to start This is the end of api.elg file when I perform "api restart" in the terminal. Any ideas why I can't start the API on this machine? Regards, Adiel -------------------------------------------------------------------------- 2019-10-04 03:15:27,812 WARN org.eclipse.jetty.webapp.WebAppContext.doStart:503 [main] - Failed startup of context o.e.j.w.WebAppContext{/web_api,file:/var/log/opt/CPsuite-R80/fw1/tmp/jetty-127.0.0.1-50276-web_api.war-_web_api-any-/webapp/},/opt/CPsuite-R80/fw1/api/webapps/web_api.warorg.springframework.beans.factory.BeanDefinitionStoreException: Unexpected exception parsing XML document from URL [jar:file:/opt/CPsuite-R80/fw1/api/lib/web_api_module_objects.jar!/com/checkpoint/management/web_api/config/web-api-module-objects-bean-config.xml]; nested exception is java.lang.RuntimeException: java.io.FileNotFoundException: class path resource [com/checkpoint/management/conf/cdm_web_services_config.xml] cannot be resolved to URL because it does not existat org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:412)at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334)at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:302)at com.checkpoint.infrastructure.spring.IgnoringDuplicateFilesBeanDefinitionReader.loadBeanDefinitions(IgnoringDuplicateFilesBeanDefinitionReader.java:51)at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:174)at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:209)at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:180)at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:125)at com.checkpoint.management.web_api.core.spring.WebApiIgnoringDuplicateBeansXmlWebApplicationContext.loadBeanDefinitions(WebApiIgnoringDuplicateBeansXmlWebApplicationContext.java:19)at org.springframework.context.support.AbstractRefreshableApplicationContext.refreshBeanFactory(AbstractRefreshableApplicationContext.java:131)at org.springframework.context.support.AbstractApplicationContext.obtainFreshBeanFactory(AbstractApplicationContext.java:522)at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:436)at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:384)at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:283)at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:111)at org.eclipse.jetty.server.handler.ContextHandler.callContextInitialized(ContextHandler.java:782)at org.eclipse.jetty.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:424)at org.eclipse.jetty.server.handler.ContextHandler.startContext(ContextHandler.java:774)at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:249)at org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1242)at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:717)at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:494)at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64)at org.eclipse.jetty.deploy.bindings.StandardStarter.processBinding(StandardStarter.java:39)at org.eclipse.jetty.deploy.AppLifeCycle.runBindings(AppLifeCycle.java:186)at org.eclipse.jetty.deploy.DeploymentManager.requestAppGoal(DeploymentManager.java:494)at org.eclipse.jetty.deploy.DeploymentManager.addApp(DeploymentManager.java:141)at org.eclipse.jetty.deploy.providers.ScanningAppProvider.fileAdded(ScanningAppProvider.java:145)at org.eclipse.jetty.deploy.providers.ScanningAppProvider$1.fileAdded(ScanningAppProvider.java:56)at org.eclipse.jetty.util.Scanner.reportAddition(Scanner.java:615)at org.eclipse.jetty.util.Scanner.reportDifferences(Scanner.java:540)at org.eclipse.jetty.util.Scanner.scan(Scanner.java:403)at org.eclipse.jetty.util.Scanner.doStart(Scanner.java:337)at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64)at org.eclipse.jetty.deploy.providers.ScanningAppProvider.doStart(ScanningAppProvider.java:121)at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64)at org.eclipse.jetty.deploy.DeploymentManager.startAppProvider(DeploymentManager.java:555)at org.eclipse.jetty.deploy.DeploymentManager.doStart(DeploymentManager.java:230)at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64)at org.eclipse.jetty.util.component.AggregateLifeCycle.doStart(AggregateLifeCycle.java:81)at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:58)at org.eclipse.jetty.server.handler.HandlerWrapper.doStart(HandlerWrapper.java:96)at org.eclipse.jetty.server.Server.doStart(Server.java:282)at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64)at org.eclipse.jetty.xml.XmlConfiguration$1.run(XmlConfiguration.java:1259)at java.security.AccessController.doPrivileged(AccessController.java:594)at org.eclipse.jetty.xml.XmlConfiguration.main(XmlConfiguration.java:1182)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:95)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)at java.lang.reflect.Method.invoke(Method.java:508)at org.eclipse.jetty.start.Main.invokeMain(Main.java:473)at org.eclipse.jetty.start.Main.start(Main.java:615)at org.eclipse.jetty.start.Main.main(Main.java:96)Caused by: java.lang.RuntimeException: java.io.FileNotFoundException: class path resource [com/checkpoint/management/conf/cdm_web_services_config.xml] cannot be resolved to URL because it does not existat com.checkpoint.infrastructure.spring.IgnoringDuplicateFilesBeanDefinitionReader.getURL(IgnoringDuplicateFilesBeanDefinitionReader.java:61)at com.checkpoint.infrastructure.spring.IgnoringDuplicateFilesBeanDefinitionReader.loadBeanDefinitions(IgnoringDuplicateFilesBeanDefinitionReader.java:43)at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:174)at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:209)at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.importBeanDefinitionResource(DefaultBeanDefinitionDocumentReader.java:239)at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.parseDefaultElement(DefaultBeanDefinitionDocumentReader.java:196)at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.parseBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:181)at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.doRegisterBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:140)at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.registerBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:111)at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.registerBeanDefinitions(XmlBeanDefinitionReader.java:493)at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:390)... 53 moreCaused by: java.io.FileNotFoundException: class path resource [com/checkpoint/management/conf/cdm_web_services_config.xml] cannot be resolved to URL because it does not existat org.springframework.core.io.ClassPathResource.getURL(ClassPathResource.java:179)at com.checkpoint.infrastructure.spring.IgnoringDuplicateFilesBeanDefinitionReader.getURL(IgnoringDuplicateFilesBeanDefinitionReader.java:58)... 63 more2019-10-04 03:15:27,815 INFO org.eclipse.jetty.deploy.DeploymentManager.addApp:132 [main] - Deployable added: /opt/CPsuite-R80/fw1/api/contexts/docs.xml2019-10-04 03:15:27,839 INFO org.eclipse.jetty.server.AbstractConnector.doStart:338 [main] - Started SelectChannelConnector@127.0.0.1:50276 ----------------------------------------------------------------------------------------------------------------------

inside

8694 10 4

run-script output

Hi,How can we retreive output for run-script API command ?I can see result on Dashboard but it's possible to have this by API ?Thanks

inside

228 2 2

Finding a URL in all custom Application/Sites rather than just one

Hi,I have a script currently utilising the mgmt api to open a specific application/site and show all the URL's listed. I then can then grep a saved output to find a single URL. I look to add filtering built into the script but has anyone had any experience with looping over all application/sites to find a single URL?Tom

inside

8017 6 2

API: How to use args in run-script ?

Hello CheckMates!Could you provide me a hint on how to use args parameter in API (v1.1) call run-script to pass arguments to an OS command or script ? Using args with mgmt._cli, postman, SCconsole returns a failed task.e. g. :mgmt._cli -r true -f json run-script script-name "ping" script "ping" args " -c1 172.17.xxx.2" targets.1 "mgmt._server_itself"returns:"mgmt._server_itself - ping" failed (100%){<omitted for brevity> "task-id" : "e1f9a669-2cf8-4248-bee7-437902810e9b", "task-name" : "mgmt._server_itself - ping", "status" : "failed",<omitted> "statusCode" : "failed", "statusDescription" : "Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline], [-p pattern] [-s packetsize] [-t ttl] [-I interface or addressas if arguments in args string value are not passed to bash. Various arguments and escape sequences tried, same result.Passing all arguments in script value works:mgmt._cli -r true -f json run-script script-name "ping" script "ping -c1 172.17.xxx.2" targets.1 "mgmt._server_itself"returns:"mgmt._server_itself - ping" succeeded (100%){<omitted> "task-id" : "0751191e-9fed-4bcf-851f-b97645dcea4c", "task-name" : "mgmt_server_itself - ping", "status" : "succeeded",<omitted> "statusCode" : "succeeded", "statusDescription" : "PING 172.17.xxx.2 (172.17.xxx.2) 56(84) bytes of data. 64 bytes from 172.17.xx.2: icmp_seq=1 ttl=128 time=0.110 ms, --- 172.17.xxx.2 ping statistics ---, 1 packets transmitted, 1...",Screened api.elg, cpm.elg, fwm.elg for clues - didn't understand how script string and args string are passed to bash.Environment: R80.10, JHF T112 Thank you for your time,andreip

inside

224 1

Script to delete objects

Hello everybody.I'm doing a script to delete objects and rules. I'm having troubles to define if the object is the last in cell. In the SmartConsole, if I go to 'Where Used' in the object, I can see if it are the Last in Cell, but in the "mgmt_cli where used" there isn't a field with this information. Does anynone have this same problem? Is there another way to do this?Thanks for while.

inside

1590 1 2

Sandblast - Threat Prevention API - Upload a file via an Webinterface

Hi there,I'm currently playing around with the Threat Prevention API and my goal is to create a web interface to upload a suspicious file to the (on premise) Sandblast appliance.This is my current partly working Python(Flask) code:@app.route('/upload', methods=['GET', 'POST'])def upload(): if request.method == 'POST': file = request.files['file'] resp=do_upload(file) return render_template('index.html', msg='success', json=resp) else: return render_template('upload.html')def do_upload(file): filestream = file.stream hostname='https://LOCALSANDBLAST:18194/tecloud/api/v1/file/upload' payload={"request":{"file_name":file.filename}} files = { 'request': (None, json.dumps(payload), 'application/json'), 'file': (file.filename, filestream) } response=requests.post(hostname, files=files) return response.text print response.textHowever the response I get from the Threat Prevention API contains the code '1006' which according to the documentation is 'PARTIALLY_FOUND: Part of the request found. If the missing data is required, upload the file.'The complete response is attached to this post.What am I doing wrong? Am I not uploading the whole file?Can you maybe provide a working example for uploading and successfully querying a threat emulation via HASH afterwards?Would be very happy to hear your ideas / approaches.Thanks in advance,Johanna

inside

232 2

Delete and set multiple routes in VSX mode

Hi all, Until now all my questions have been answered by the various Checkmate Posts.This week I will be migrating a VSX R80.20 system from dedicated physical interfaces, as internal and external to a combined internal bond, and a combined external bond interface for all the virtual systems to share. In order to do this, I have to delete the VLAN interfaces from the current physical interfaces. I have created a little script to do this. No problems there, but I also have to delete the static routes before I can delete the VLAN from the interface. The routes are visible in the routedx.conf files at OS level. But this file is created by a Checkpoint process that probably will overwrite the file when I change it. SO - NO GO. The clish config also displays the routes.Adding a route here displays an error telling me that routes need to be added in the GUI. During the migration I have to delete and add about 50 routes since the interfaces will change. Is there a way to prepare this so I can do this using the CLI?I have read about the "run-script" option but that only looks useful to show information from the system.I don't want to use the GUI for this task because it takes a lot of time and a lot of mouse clicks. Currently, I can't add images because its a sunday and somebody killed my management VM.Hope you can help me on this one.

inside

329 4

Mgmt API - feature to update Gateway's MTA settings

Hi guys ,I am looking for the script/command needed to be run which takes care of MTA config ( adding mail domain , next hop ) on gateway automatically everytime a new Gateway spins up . Is there any know script/ cmd syntax I can use to do this in the below auto-provision of VMSS ?? I didn’t find any mgmt_cli command …

inside

1265 6

Get early access to our new Threat Prevention APIs

Take control of new Threat Prevention APIs powered by the largest Threat Cloud in the industry: URL Reputation – for a domain/URL returns the classification and risk in accessing the resource File Reputation – for a file digest (md5/sha1/sha256/sha512) returns the risk in downloading the file without the need to scan it IP Reputation - for an IP address returns it’s classification and risk in accessing a resource hosted on it Mail Security – upload an email for scanning against malware and phishing attacks, based on award winning Sandblast engines All APIs are RESTful, simple to use and can be integrated as part of a SOAR application, home-made application and more! If you’re a Check Point customer interested in participating in the early availability stage drop me a mail at yoav@checkpoint.com

inside

2414 2 7

New Unified API Reference

I’m glad to share our new API Reference portal . This site will be “one-stop-shop” for all CP APIs references. Currently we have added Management APIs and Gaia APIs, we are in progress of adding the rest of APIs (SandBlast , TP APIs etc.) Regards, Amiad.