API / CLI Discussion and Samples

The Best of
CheckMates!

CHECK OUT THE WINNERS

CheckMates Nuggets
Security Effectiveness

WATCH NOW

CheckMates GO
Episode #05

Listen Now!

The CheckMates
Challenge

JOIN NOW!

Create a Post

API / CLI Discussion and Samples

Do you have questions on how to use any of Check Point's API commands, including via the CLI using mgmt_cli? Looking for sample code? This is the place to find answers!

RECENT POSTS

MOST POPULAR

FEATURED POSTS

inside

270300 12 12

Powershell script to automate the creation of required Office 365 IP addresses or URLs in a Checkpoint management server

Hi,Here is a Powershell script that will automate the creation of all Office 365 IP addresses and URLs in a management server R80+ :*** UPDATE ***Here is an improved version of the script : Create-O365CheckpointObjects.ps1It depends on the ConvertFrom-O365AddressesXMLFile module (https://github.com/it-praktyk/Conver...dressesXMLFile). So you need to install it first.Here is the help :NOM Create-O365CheckpointObjects.ps1RÉSUMÉ Create the required objects in a Checkpoint R80+ management server to allow Office 365 trafficSYNTAXE Create-O365CheckpointObjects.ps1 [-Server] <String> [[-Port] <Int32>] [[-DomainName] <String>] [[-Service] <String>] [[-Prefix] <String>] [[-Category] <String>] [-Type] <String> [<CommonParameters>]DESCRIPTION This script will connect to https://support.content.office.net/en-us/static/O365IPAddresses.xml and download an XML file containing the required objects to allow Office 365 traffic to pass. It will then create the objects (IPv4, IPv6 addresses or URLs) into the Checkpoint management server using the R80+ API, according to the selected parameters. It depends on the ConvertFrom-O365AddressesXMLFile module (https://github.com/it-praktyk/Convert-Office365NetworksData/tree/master/ConvertFrom-O365AddressesXMLFile).PARAMÈTRES -Server <String> The mandatory Checkpoint management server hostname or IP address -Port <Int32> The Checkpoint R80 API port By default, 443 will be used -DomainName <String> -Service <String> An optional Office 365 to filter on (among "WAC","Sway","Planner","Yammer","OfficeMobile", "ProPlus", "RCA","OneNote","OfficeiPad","EXO","SPO","Office365Video","LYO","Identity","CRLs","o365" and "EOP" If not specified, all Office 365 services objects will be created -Prefix <String> A prefix for the Office 365 objects in the Checkpoint management server By default, "O365" will be used -Category <String> The primary category for the Office 365 application objects in the Checkpoint management server By default, "Microsoft & Office365 Services" will be used -Type <String> A mandatory object type to filter on (among "IPv4","IPv6","URL") <CommonParameters> Cette applet de commande prend en charge les paramètres courants*: Verbose, Debug, ErrorAction, ErrorVariable, WarningAction, WarningVariable, OutBuffer, PipelineVariable et OutVariable. Pour plus d’informations, voir about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216). -------------------------- EXEMPLE 1 -------------------------- PS C:\>Create-O365CheckpointObjects -Server cpserver -Type IPv4 Description: Will create the IPv4 objects for all the Office 365 apps in a Checkpoint management server named "cpserver" -------------------------- EXEMPLE 2 -------------------------- PS C:\>Create-O365CheckpointObjects -Server cpserver -Service LYO -Type IPv6 -Verbose Description: Will create the IPv6 network objects for Skype for Business in a Checkpoint management server named "cpserver" -------------------------- EXEMPLE 3 -------------------------- PS C:\>Create-O365CheckpointObjects -Server cpserver -Service EOP -Type URL -Category "Exchange" Description: Will create an application object for Exchange Online, with the required URLs, and a primary category set to "Exchange"REMARQUES Pour consulter les exemples, tapez: "get-help Create-O365CheckpointObjects.ps1 -examples". Pour plus d'informations, tapez: "get-help Create-O365CheckpointObjects.ps1 -detailed". Pour obtenir des informations techniques, tapez: "get-help Create-O365CheckpointObjects.ps1 -full".‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

inside

102882 44 10

Security Gateway Inventory

About 6 months ago, CP gave us a script to run from Provider 1 to grab all gateways and their corresponding model/software version. However, it was a very inconsistent result. Meaning that, some (active) gateways came back with just host name and IP and then some came back with host name/IP/OS Version/model number.Anybody aware of a way to pull : Gateway Info that includes (Hostname/IP/OS-Version/Model)? I know you can export a list through network objects, but I just want active count for inventory. Any such method/script?

inside

52516 4 3

cpAnsible installation on Ubuntu 16.04

Hi guys, I am installing Ansible with CheckPoint module in my lab (on Ubuntu 16.04.01) according to the guide from: https://github.com/CheckPointSW/cpAnsible I installed the Ansible 2.0.0.2 from Ubuntu repository. I am getting following error.TASK [login] *******************************************************************task path: /home/yevgeniy/ansible/cpx_add_host.yml:4fatal: [127.0.0.1]: FAILED! => {"failed": true, "msg": "ERROR! error importing module in /usr/share/my_modules/check_point_mgmt/check_point_mgmt.py, expecting format like 'from ansible.module_utils.basic import *'"} The error comes from:yevgeniy@kubuntu-desktop:/usr/share/my_modules/check_point_mgmt$ pwd/usr/share/my_modules/check_point_mgmtyevgeniy@kubuntu-desktop:/usr/share/my_modules/check_point_mgmt$ ls -al-rw-r--r-- 1 root root 10115 Sep 13 17:31 check_point_mgmt.pycat check_point_mgmt.py#!/usr/bin/pythonimport astimport jsonimport sysfrom ansible.module_utils.basic import AnsibleModule… The file and object are exist:yevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$ pwd/usr/lib/python2.7/dist-packagesyevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$yevgeniy@kubuntu-desktop:/usr/lib/python2.7/dist-packages$ cat ansible/module_utils/basic.py | grep AnsibleModuleclass AnsibleModule(object): Below is the configuration and playbook. I would very appreciate your feedback. /etc/ansible/hosts[localhost]127.0.0.1[localhost:vars]ansible_user=yevgeniyansible_ssh_pass=qwe123ansible_python_interpreter=/usr/bin/python2.7# Optional (variables detailing the Check Point's management server access):mgmt_server=192.168.168.50mgmt_user=adminmgmt_password=qwe123 /etc/ansible/ansible.cfg[defaults]#inventory = /etc/ansible/hostslibrary = /usr/share/my_modules/host_key_checking = False Playbookyevgeniy@kubuntu-desktop:~/ansible$ cat cpx_add_host.yml---- hosts: "localhost" tasks: - name: "login" check_point_mgmt: command: login parameters: username: "{{mgmt_user}}" password: "{{mgmt_password}}" management: "{{mgmt_server}}" fingerprint: "FA:5A:A6:AC:93:D0:BD:69:9E:E1:72:05:1D:73:24:70:29:17:37:C1" register: login_response - name: "add-host-cpx-host1" check_point_mgmt: command: add-host parameters: name: "cpx-host1" ip-address: "192.168.202.100" session-data: "{{login_response}}" - name: "publish" check_point_mgmt: command: publish session-data: "{{login_response}}" - name: "logout" check_point_mgmt: command: logout session-data: "{{login_response}}" yevgeniy@kubuntu-desktop:~/ansible$ sudo ansible-playbook cpx_add_host.yml -vvvvvUsing /etc/ansible/ansible.cfg as config fileLoaded callback default of type stdout, v2.01 plays in cpx_add_host.yml PLAY *************************************************************************** TASK [setup] *******************************************************************<127.0.0.1> ESTABLISH SSH CONNECTION FOR USER: yevgeniy<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set ssh_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r -tt 127.0.0.1 '( umask 22 && mkdir -p "$( echo $HOME/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131 )" && echo "$( echo $HOME/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131 )" )'<127.0.0.1> PUT /tmp/tmpJ04k4u TO /home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/setup<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set sftp_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 sftp -b - -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r '[127.0.0.1]'<127.0.0.1> ESTABLISH SSH CONNECTION FOR USER: yevgeniy<127.0.0.1> SSH: ansible.cfg set ssh_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)<127.0.0.1> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no)<127.0.0.1> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User=yevgeniy)<127.0.0.1> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)<127.0.0.1> SSH: PlayContext set ssh_common_args: ()<127.0.0.1> SSH: PlayContext set ssh_extra_args: ()<127.0.0.1> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r)<127.0.0.1> SSH: EXEC sshpass -d14 ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o User=yevgeniy -o ConnectTimeout=10 -o ControlPath=/home/yevgeniy/.ansible/cp/ansible-ssh-%h-%p-%r -tt 127.0.0.1 'LANG=de_DE.UTF-8 LC_ALL=de_DE.UTF-8 LC_MESSAGES=de_DE.UTF-8 /usr/bin/python2.7 /home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/setup; rm -rf "/home/yevgeniy/.ansible/tmp/ansible-tmp-1536847648.88-30557354590131/" > /dev/null 2>&1'ok: [127.0.0.1] TASK [login] *******************************************************************task path: /home/yevgeniy/ansible/cpx_add_host.yml:4fatal: [127.0.0.1]: FAILED! => {"failed": true, "msg": "ERROR! error importing module in /usr/share/my_modules/check_point_mgmt/check_point_mgmt.py, expecting format like 'from ansible.module_utils.basic import *'"} PLAY RECAP *********************************************************************127.0.0.1 : ok=1 changed=0 unreachable=0 failed=1 yevgeniy@kubuntu-desktop:~/ansible$ Mit freundlichen Grüßen / Best regards Yevgeniy Yeryomin | Professional Services Consultant Check Point Software Technologies | M +49 151 4401 9871 | * yyeryomin@checkpoint.comAdvanced Technical Account Manager | Learn More

inside

49346 14 3

Disable a rule on R80.10 using Python Web API

Hello,I have a management server running R80.10, which has almost 20 devices connected and has hundreds of rules defined. I wanted to disable rules that are not in use currently via Web API using Python script. Please guide me if there is way to do the same.Please help me.

inside

48234 7

Ansible playbooks wont run outside of specific directory

Hi, I'm trying to solve this Ansible playbook issueIf my playbooks are in this directory /usr/lib/python2.7/site-packages/ansible/modules/extrasthe playbooks run fine. When using Tower, it puts them in its own folder which is /var/lib/aws/projects/<dynamic>/whatever.ymland I get the following message (both in tower and when I run locally like below) I have tried multiple things to try to straiten this out. Any suggestions?

inside

44451 14 31

Leveraging the R80.10 API to Automate and Streamline Security Operations

On 15th August 2017 we did a webinar with Ryan Darst‌ about the automation and orchestration capabilities you can achieve with the R80.10 API. Specifically, this session covered:Introduction to using the R80.10 APIs using a variety of tools from Postman to AnsibleTips on leveraging the API from both the R80.10 CLI and from the RESTful API to do simple tasks from adding objects and services to adding rulesAdditional use cases for using other features in the R80 API from policy verification to running scripts on gatewaysA demonstration of a complete Check Point cloud auto-scaling environment using Ansible and the R80.10 APIsThe content presented is below:Slides: How to use R80.10 API for Automation and Streamlined Security (PPT)‌Video: How to use R80.10 API for Automation and Streamlined Security (Video) Scripts: CheckMates_Aug15_Demos.zip‌Q&A: https://community.checkpoint.com/docs/DOC-2181?sr=search&searchId=a87f1f36-8fe9-4b5a-ac48-837a0d545793&searchIndex=1

inside

37274 5

multidomain and mgmt_cli

I was trying to add a number of object this week, I had done some last week. Last week I added them to 1 domain and now I wanted to add them to another domain, what I did upfront was mdsenv <Domain> and started issuing the commands, this worked like a charm.Today however when I tried to add some objects to another domain, using the same way, first set the mdsenv to the correct domain, then started issuing the (copy paste) the mgmt_cli commands, the objects ended up in the domain that I used last week???I found out by going in the second domain and use the new network objects but were not there. Then when I issued the mgmt_cli show networks command, it showed me all the network objects from the other domain I worked on last week.Hmm, ok maybe I need to do a set domain name <domain> command first? Well in the expert mode with mgmt_cli, that did not work, unknown object.So ok lets try from clish and use the mgmt commands instead, as the first command used mgmt set domain name <Domain> and then issued the add network commands. they were accepted, no error messages. Going into Smartconsole, none of the networks I added are there, nor in the other domain nor in the Global domain.What am I doing wrong?

inside

36070 14 4

Proper place to put custom scripts

Hi,So, I wrote my own backup script for Security Management Server and I thought the proper place to put it in is /usr/local/sbin/Well, I was wrong. When I upgraded server from R80.10 to R80.20 my script was silently deleted.Where shall I place my scripts so that they are preserved between upgrades?

inside

35418 19 1

mgmt_cli on Ubuntu

Hey,Has anyone installed mgmt_cli on Ubuntu (no Check Point installation on this server)? Which libraries etc. do I need to get it working?Thanks!

inside

35100 262 62

Python tool for exporting/importing a policy package or parts of it

Overview ExportImportPolicyPackage tool enables you to export a policy package from a R80.x management database to a .tar.gz file, which can then be imported into any other R80.x management database. This tool can be used for backups, database transfers, testing, and more. In the case you are exporting a policy package from a CMA, please verify that a global policy was NOT assigned to that CMA.The tool doesn't support exporting a policy with global policy assigned! Description This tool enables you to export a policy package (Access Policy, Threat Policy or both) from a management server into a .tar.gz file. Notice There are some types of objects that the script might not be able to export.In such a case, an appropriate dummy object will be exported instead, and a message will be logged into the log files to notify you of this.In the Check Point SmartConsole you can easily replace each of these objects by searching "export_error" in the search field, see where each object is used, create the necessary object manually, then replace it. Instructions Download the latest version from our GitHub repository: https://github.com/CheckPointSW/ExportImportPolicyPackage First, make sure you have [2.7.9 <= Python <= 2.7.14] installed on the machine running the script.To export a package, run the import_export_package.py script. An interactive menu will guide you the rest of the way.Command line flags may also be set in order to skip some or all of the menu.A lot more details can of course be accessed with the [-h] option. This option also prints the current version of the tool. Current tool version is V3.0. Limitations This export/import script does not gather all data from a given management server/CMA.In general, it is limited by the R80.x Management APIs.Specifically, this means: CMAs with a Global Policy assigned cannot be exported Workaround: unassign the Global Policy prior to export Gateway/Cluster objects have to be recreated Placeholder objects will be created UserCheck messages have to be recreated Placeholder objects will be created The Internal Certificate Authority will not be copied. This means: Re-establishing SIC with the appropriate gateways Re-generating VPN certificates Manually recreating HTTPS Inspection and DLP Rules Other objects not currently readable/writable via the R80.x API will not be copied Tested on version R80.xReleases earlier than R80 lack the necessary API support and are not supported. Source Code Availability The source code is available through GitHub: https://github.com/CheckPointSW/ExportImportPolicyPackage FAQ Replies to this thread have locked.Please refer to the FAQ below before you create a new post with your question. When I run this tool, I get the message: APIResponse received a response which is not a valid JSON. This most likely means you haven't enabled the API server yet.See: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Enabling-web-api/m-p/32641 I get an error message related to server fingerprint Use the --unsafe option to ignore this error. Can this tool export more than one policy package at a time? Not currently, but you could call the tool in a script multiple times. NOTICE: By using this sample code you agree to terms and conditions in this Terms and Conditions

inside

35000 10 8

How to test the Management API with the Cloud Demo

The nice thing with the R80.10 Cloud Demo option is that you no longer need a real Check Point license to test security management features. And the API is one of them.1. Get the server IP by clicking “copy server IP” 2. Get an administrator with a password that you know of, by creating one at “Permissions & Administrators” or by changing the password of one of the existing administrators. Publish your changes. Now you can test your tools by connecting to this server IP with the administrator username and password.

inside

33645 11 2

Script for multiple network/host/group object creation

Hello We recently started with R80 Management. One thing we would like to use is api scripts. we would like to create script that can read from csv/txt file and create network/host/group object. we have dynamic environment and new rules are requested all the time. this would reduce our time creating objects.Is this something possible to create and could we have some example?Thank you Ismar

inside

32533 7 14

Check Point - HEX to IP Converter Tool?

Is there a Check Point tool to easily convert hexadecimal values to IP addresses on the CLI? I use the following lines in scripts: hexaddr=$(echo 12cd34ef)ipaddr=$(printf "%d." $(echo $hexaddr | sed 's/../0x& /g' | tr ' ' '\n' | tac) | sed 's/\.$/\n/')echo $ipaddr Is there an easier way? Regards Heiko Ankenbrand

inside

32426 6

Permission to create gateway object from API

What is the permission required for API to create a gateway object?I have created a role using custom mode so I can remove the excessive privilege later, and I have assigned all the possible privilege with write permission. I am still getting run time error when creating a simple gateway object from ansible. It works find if the role is given full write permission. Error message below:fatal: [127.0.0.1]: FAILED! => {"changed": false, "failed": true, "msg": "Command 'add-simple-gateway {u'one-time-password': u'aaa12345', u'interfaces': [{u'ipv4-network-mask': u'255.255.255.0', u'anti-spoofing': u'true', u'ipv4-address': u'10.0.1.88', u'name': u'eth0', u'topology': u'External'}, {u'anti-spoofing': u'true', u'name': u'eth1', u'topology-settings': {u'ip-address-behind-this-interface': u'network defined by the interface ip and net mask'}, u'ipv4-network-mask': u'255.255.255.0', u'ipv4-address': u'172.16.1.88', u'topology': u'Internal'}], u'name': u'demo_gateway', u'ip-address': u'192.0.1.88', u'comments': u'added by Ansible'}' failed with error message: Runtime error: Error reading XMLStreamReader: Unexpected EOF in prolog at javax.xml.stream.SerializableLocation@c1137a34. All changes are discarded and the session is invalidated."}

inside

29137 4 1

problems deleting an application access-layer via API

I have mulitple policy packages that have a security layer and a application layer. The application layer appeared after importing from migrate import from R77, i do not want it. I would like to remove this layer from all these policy packages.The application layer has only 1 ruleAny -> Internet -> accept -> detailed log :accountingI thought i would just be able to delete the layer from the API. It deletes perfectly from the SmartConsole. I have trieddeleting the application access layermgmt_cli -r true -d Mgmt1 delete access-layer uid "12345678-abcd-4710-a798-12345609f989"code: "generic_err_object_deletion"message: "Object MyPolicy Application could not be deleted because it is referenced by other objects, run where-used command for details"I have verified that I have the correct id for the application layer, using show object uid.mgmt_cli -r true -d Mgmt1 where-used uid "12345678-abcd-4710-a798-12345609f989"code: "generic_err_object_not_found"message: "Requested object [12345678-805c-4710-a798-12345609f989] not found"where used doesnt work on this object, ok expected i think.I tried to delete the 1 rule from the application access layermgmt_cli -r true -d Mgmt1 delete access-rule layer "12345678-abcd-4710-a798-12345609f989" rule-number 1 --format json{ "code" : "generic_error", "message" : "Runtime error: Cannot delete the only child of the rulebase."}So , can i delete this using the API, what am i missing?

inside

101 1

Check Point Ansible Module in Ansible 2.8 Version with MDS

Hello, we are testing ansible automatisation on our MDS . I used this SK, but I can't find any information how to specify a special CMA Domain: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114661&partition=General&product=Security My Hosts File looks like this: /etc/ansible/hosts[checkpoint]1.1.1.1[checkpoint:vars]ansible_httpapi_use_ssl=Trueansible_httpapi_validate_certs=Falseansible_user=api-useransible_password=passwordansible_network_os=checkpoint My Ansible runbook lookes like that: cat create-host2.yml---- hosts: checkpointconnection: httpapi# domain: "Global"tasks:- name: add-hostcp_mgmt_host:ip_address: "192.0.2.1"name: "New Host 1"state: "present"Does anyone know how to specify a CMA Domani in this Version? In the old Version https://github.com/CheckPointSW/cpAnsible you could do this with the parameter -domain Can anyone help me with that?

inside

Using the API to map an Access Layer to a Policy Package

Hi friends-I'm looking to use the API to add a rule to a layer and then install policy on the appropriate package (or packages for a shared layer). In SmartConsole, when I view layers (Manage policies and layers...), it shows me the package(s) the layer is used on, but I can't seem to find that mapping in the API. I've tried both show access-layer and show access-layers, but neither give me the packages. I tried doing a where-used on my layer UID, but that just gives me an error. I've noticed that showing all my packages lists the layers that are used, but what about the other way around? How do find which policy(ies) my access layer is a part of?I'm on v1.5.Thanks!

inside

159 3

Script in creating object and add in a object group using CLI

What is the command line script to create object/object group and add object in an object group. Like hundred of objects (IPs).I am using Checkpoint R80.10.

inside

105 3

R80.40 API v1.6 Changelog

Changelog What's New in v1.6 This release, API version 1.6, introduces several updates for existing APIs. Deprecated API commands from this version: show data-center command is deprecated, use show data-center-server instead. show data-centers command is deprecated, use show data-center-servers instead. New APIs (35) API Key (2) API command Description add api-key Add API key for administrator, to enable login with it. For the key to be valid publish is needed.When using mgmt_cli tool, add –f json to get the key in the command’s output delete api-key Delete the API key. For the key to be invalid publish is needed. Data Center Server (4) API command Description delete data-center-server Delete existing Data Center Server using name or uid. set data-center-server Edit existing Data Center Server using name or uid. Data Center Server represents the connection to a cloud environment. The Data Center Server contains Data Center Objects, these objects can be imported from it using the add-data-center-object command show data-center-server Retrieve existing Data Center Server using name or uid. show data-center-servers Retrieve existing Data Center Servers. LSV Profile (5) API command Description add lsv-profile Add a new Large Scale VPN object. When used inside a VPN Community, the object enables communication between a large amount of externally managed VPN peers. delete lsv-profile Delete existing LSV profile object using object name or uid. set lsv-profile Set LSV Profile object's fields. Set CA by uid or name, change peers limit or restrict encryption domain. show lsv-profile Retrieve existing LSV profile object using object name or uid. show lsv-profiles Retrieve all objects. Migration (4) API command Description backup-domain Back up the Domain database and applicable Check Point configuration. This command can be used in backup and restore operations. This command is available only in a Multi-Domain environment and when logged into the MDS domain. For known limitations see sk146953 migrate-export-domain Export the Domain database and applicable Check Point configuration. This command can be used in export and import operations. This command is available only when logged into the system domain. For known limitations see sk156072 migrate-import-domain Imports the exported Domain database and applicable Check Point configuration. This command can be used in import operations. This command is available only when logged into the system domain. For known limitations see sk156072 restore-domain Restores the backed-up Domain database and applicable Check Point configuration. This command can be used in restore operations. This command is available only in a Multi-Domain environment and when logged into the MDS domain. For known limitations see sk146953 Misc. (1) API command Description install-database Copies the user database and network objects information to specified targets. Server Certificate (5) API command Description add server-certificate Import server certificates for inbound HTTPS traffic inspection.You can use the imported server certificates in the Certificate column of the HTTPS Inspection Policy. delete server-certificate Delete existing server certificate using name or uid. set server-certificate Edit existing server certificate using name or uid. show server-certificate Show existing server certificate using name or uid. show server-certificates Show existing server certificates. Session Management (2) API command Description revert-to-revision Revert the Management Database to the selected revision. verify-revert Verify the Management Database can revert to the selected revision. Simple Cluster (5) API command Description add simple-cluster Create new object. delete simple-cluster Delete existing object using object name or uid. set simple-cluster Edit existing object using object name or uid. show simple-cluster Retrieve existing object using object name or uid. show simple-clusters Retrieve all objects. SmartTasks (5) API command Description add smart-task Create new object. delete smart-task Delete existing object using object name or uid. set smart-task Edit existing object using object name or uid. show smart-task Retrieve existing object using object name or uid. show smart-tasks Retrieve all objects. Triggers (2) API command Description show smart-task-trigger Retrieve existing object using object name or uid. show smart-task-triggers Retrieve all objects. Updated APIs (10)Threat Profile (3) API command Added fields Removed fields Updated fields Description set threat-profile 1 0 0 Edit existing object using object name or uid. show threat-profile 2 0 0 Retrieve existing object using object name or uid. add threat-profile 1 0 0 Create new object. Threat Protection (1) API command Added fields Removed fields Updated fields Description show threat-protections 1 0 0 Retrieve all objects. VPN Community Meshed (3) API command Added fields Removed fields Updated fields Description show vpn-community-meshed 1 0 0 Retrieve existing object using object name or uid. set vpn-community-meshed 2 0 0 Edit existing object using object name or uid. add vpn-community-meshed 2 0 0 Create new object. VPN Community Star (3) API command Added fields Removed fields Updated fields Description set vpn-community-star 2 0 0 Edit existing object using object name or uid. show vpn-community-star 1 0 0 Retrieve existing object using object name or uid. add vpn-community-star 2 0 0 Create new object. Deprecated APIs (2)Data Center Server (2) API command Description show data-center Retrieve existing Data Center Server using name or uid. Starting from version 1.6 of the Check Point Management API, this command is deprecated . Use the show data-center-server command instead show data-centers Retrieve existing Data Center Servers. Starting from version 1.6 of the Check Point Management API, this command is deprecated . Use the show data-center-servers command instead

inside

3152 14 5

Search multiple CMA

In R77.30 one had the possibility to search all CMAs for object usage. I cannot find this feature in R80.10 MDS. There is no mention of the Cross-Domain Management Server Search function in the CP_R80.10_Multi-DomainSecurityManagement_AdminGuide.This was especially useful to find global object use, to limit the number of policies one had to push after updating a single object.Any suggestions for a replacement?Best regards,Harald

inside

254 5

Having issues with publishing policy via web API

Hi,I have a powershell script that is meant to do the following but is failing on publishing policy. The API gives me the following error but not sure why as I don't have any unpublished changes. Below are the steps.-Add Host (Sucess)-Add Host to Group (Sucess)-Publish Policy (Fail)-Install Policy (Fail)2019-11-13 09:43:11,233 INFO [GUI] org.apache.cxf.interceptor.LoggingInInterceptor.log:250 [qtp2049910860-30] - Inbound Message----------------------------ID: 76Address: http://127.0.0.1:50276/web_api/add-hostEncoding: ISO-8859-1Http-Method: POSTContent-Type: application/jsonHeaders: {Accept=[text/plain], connection=[keep-alive], Content-Length=[92], content-type=[application/json], Host=[127.0.0.1:50276], User-Agent=[mgmt_cli_gui], X-chkp-debug=[GUI], X-chkp-sid=[aM8KIGMuWuP8rNWBhDI8LzLVXZtR6-z9kIVee-EFYmc], X-Forwarded-For=[127.0.0.1], X-Forwarded-Host=[127.0.0.1], X-Forwarded-Host-Port=[443], X-Forwarded-Server=[10.130.181.25]}Payload: {"groups":"AttackersList","ip-address":"144.139.158.155","name":"attacker-144.139.158.155"}--------------------------------------2019-11-13 09:43:11,238 INFO [GUI] com.checkpoint.management.web_api_is.utils.helpers.ApiCache.<init>:21 [qtp2049910860-30] - Cache created and initialized2019-11-13 09:43:11,239 INFO [GUI] com.checkpoint.management.web_api.web_services.WebApiEntryPoint.logRequestedCommandInfo:51 [qtp2049910860-30] - Executing [add-host] of version 1.3 (references 1)2019-11-13 09:43:11,834 ERROR [GUI] com.checkpoint.management.web_api.utils.WebApiCommandExceptionUtils.getErrorReply:94 [qtp2049910860-30] -com.checkpoint.web_services.faults.ValidationRemoteFault: 2 Blocking validation errors were found.at sun.reflect.GeneratedConstructorAccessor264.newInstance(Unknown Source)at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:57)at java.lang.reflect.Constructor.newInstance(Constructor.java:437)at org.apache.cxf.interceptor.ClientFaultConverter.processFaultDetail(ClientFaultConverter.java:182)at org.apache.cxf.interceptor.ClientFaultConverter.handleMessage(ClientFaultConverter.java:82)at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)at org.apache.cxf.interceptor.AbstractFaultChainInitiatorObserver.onMessage(AbstractFaultChainInitiatorObserver.java:113)at org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:69)at org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:34)at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:802)at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1642)at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1533)at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1336)at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:652)at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:516)at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:425)at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:326)at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:279)at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:139)at com.sun.proxy.$Proxy244.updateObjectWithReturnControlErrorLevel(Unknown Source)at com.checkpoint.management.web_api_is.utils.managers.RemoteObjectCrudManager.updateObjectWithReturn_aroundBody30(RemoteObjectCrudManager.java:24)at com.checkpoint.management.web_api_is.utils.managers.RemoteObjectCrudManager$AjcClosure31.run(RemoteObjectCrudManager.java:1)at org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:149)at com.checkpoint.management.web_api_is.aspects.logging.WebApiMethodLoggerAspect.aroundMethodLoggerTest(WebApiMethodLoggerAspect.java:13)at com.checkpoint.management.web_api_is.utils.managers.RemoteObjectCrudManager.updateObjectWithReturn(RemoteObjectCrudManager.java:72)at com.checkpoint.management.web_api_is.core.handler.base.ApiObjectRequestHandler.doUpdateObjectForAdd(ApiObjectRequestHandler.java:34)at com.checkpoint.management.web_api_is.core.handler.base.ApiCrudRequestHandler.add_aroundBody0(ApiCrudRequestHandler.java:19)at com.checkpoint.management.web_api_is.core.handler.base.ApiCrudRequestHandler$AjcClosure1.run(ApiCrudRequestHandler.java:1)at org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:149)at com.checkpoint.management.web_api_is.aspects.logging.WebApiMethodLoggerAspect.aroundMethodLoggerTest(WebApiMethodLoggerAspect.java:13)at com.checkpoint.management.web_api_is.core.handler.base.ApiCrudRequestHandler.add(ApiCrudRequestHandler.java:52)at com.checkpoint.management.web_api.core.handler.objects.network_objects.host.HostRequestHandler.add(HostRequestHandler.java:11)at sun.reflect.GeneratedMethodAccessor165.invoke(Unknown Source)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)at java.lang.reflect.Method.invoke(Method.java:508)at com.checkpoint.management.web_api_is.utils.WebApiReflectionUtils.invoke(WebApiReflectionUtils.java:7)at com.checkpoint.management.web_api.web_services.WebApiEntryPoint.postEntryPoint(WebApiEntryPoint.java:81)at sun.reflect.GeneratedMethodAccessor120.invoke(Unknown Source)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)at java.lang.reflect.Method.invoke(Method.java:508)at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:181)at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:97)at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:204)at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:101)at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59)at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96)at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:251)at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234)at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208)at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160)at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:171)at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:293)at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:212)at javax.servlet.http.HttpServlet.service(HttpServlet.java:755)at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:268)at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:686)at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1494)at org.eclipse.jetty.servlets.CrossOriginFilter.handle(CrossOriginFilter.java:247)at org.eclipse.jetty.servlets.CrossOriginFilter.doFilter(CrossOriginFilter.java:210)at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)at com.checkpoint.management.web_api.core.filter.LogCustomDebugFieldFilter.doFilter(LogCustomDebugFieldFilter.java:19)at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1474)at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:499)at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:557)at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1086)at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:428)at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193)at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1020)at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:255)at org.eclipse.jetty.server.handler.IPAccessHandler.handle(IPAccessHandler.java:203)at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:154)at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)at org.eclipse.jetty.server.Server.handle(Server.java:370)at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:489)at org.eclipse.jetty.server.AbstractHttpConnection.content(AbstractHttpConnection.java:960)at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.content(AbstractHttpConnection.java:1021)at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:865)at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:240)at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608)at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543)at java.lang.Thread.run(Thread.java:785)

inside

Help Exporting Rulebase Data

Hi, I have what i thought would be a simple requirement to export our rulebase to csv for me to share some information on some specific rules. I have looked around the forum and have struggled to land the best and simplest way of doing this.The export option in R80 smartdashboard GUI does not work for me as i need to understand the nested groups or the objects / subnets inside of the groups as well as the high level group information.Is there anything around that is already pre-written script wise to make this happen? running python directly from my machine will be a challenge and my scripting knowledge is limited. Running R80.20. Any help would be really appreciated.

inside

392 5 2

Finding a URL in all custom Application/Sites rather than just one

Hi,I have a script currently utilising the mgmt api to open a specific application/site and show all the URL's listed. I then can then grep a saved output to find a single URL. I look to add filtering built into the script but has anyone had any experience with looping over all application/sites to find a single URL?Tom

inside

202 2

How to use run-script to get IPS information on a VS of VSX?

I am trying to use run-script to get IPS information on a VS of VSX. Say VS 3 on cli I could do following:vsenv 3ips statBut if I put it in run-script as follow, api could not find vsenv command.mgmt_cli -r true -d Mydomain -VSX run-script script-name test script "vsenv3; ips stat" targets.1 vsx1 -f json Also tried to put the two commands in a script, test.sh:#!/bin/bashvsenv 3ips statthen runmgmt_cli -r true -d Mydomain -VSX run-script script-name test script "/mydir/test.sh" targets.1 vsx1 -f jsonit does not work either. Any idea how to get this to work or any way that can get IPS info on VS?

inside

16637 15 6

Bulk Add Network Objects

I am looking for advice on how to bulk add network objects. I need to add around 550 networks and we are on GAIA R80.10. I have read some about dbedit, Using a dbedit script to create new network objects and network object groups, but I am not sure if that would still be the best method. I will also mention I have never used dbedit. When adding these network objects I would also like to add a description on each network object. The dbedit link does not include the syntax for the description. I came across a thread on cpug that If R80, there are more robust CLI for these things. You can find documentation and several examples at https://community.checkpoint.com.Thanks in advance!

inside

1499 9 12

o365 dynamic objects script

This script pulls the current list of office365 IP Addresses referenced from Office 365 IP Address and URL Web service | Microsoft Docs to https://endpoints.office.com/endpoints/worldwide. It then creates dynamic objects for each set of Service Areas that have ipv4network ranges defined in the json document. Once run once an administrator should pull the resulting objects to populatethe policy and then rerun once policy is pushed.This does not have scheduling at this time.This has been updated to version 3.

inside

201 1

Create list of IPS protections set for packet capture in a specific profile

Used mgmt_cli to generate a json formatted file (ips.json) of all IPS protections (mgmt_cli show threat-protections details-level full) but cannot figure out how to parse out only the profiles with packet capture enabled. cat ips.json | jq ".protections [] | [.name, .profiles]"

inside

971 6 11

Blocking TOR exit nodes with Python and R80.10 API

Hi all,I wrote a script in Python using our API. The goal was clear, block around 1k IP addresses automatically and in a visual way, not through fw sam rules You can execute this script every day manually or you can schedule it using Crontab for example.Tu use it in your environment you just need to change these variables at the begining and execute it! You can find the script here: GitHub - toledanosjesus/chkp After the first execution of the script, you just need to configure correctly your firewall policy. You need to have something similar to this:Be aware this script is using python 2.7. You'll need to modify it a bit in case you want to use python 3.xEnjoy!

inside

376 7

Read-Only account for Gaia API?

For the GAIA API we are trying to create a role that allows the users to only use show commands, but currently all we can get working is a user with the full admin role. In our case we are using TacAcs authentication and the role associated to this also needs to be assigned otherwise it will not work. Any idea how to configure the role for a Read-Only API user?

inside

3209 19 14

Basic script for importing IP Address objects from feed (here office365)

Can be adapted to other feeds with CIDR addresses.Created Objects are then added to a group - defined at the topcompares current group members with new feed and adds new / removes unused ones.Logging is kind of ugly, but in progress. i planned to run this every day on my lab environment as cron. kind of works cheers,Danielany hints and improvements appreciated

inside

1553 6

Get early access to our new Threat Prevention APIs

Take control of new Threat Prevention APIs powered by the largest Threat Cloud in the industry: URL Reputation – for a domain/URL returns the classification and risk in accessing the resource File Reputation – for a file digest (md5/sha1/sha256/sha512) returns the risk in downloading the file without the need to scan it IP Reputation - for an IP address returns it’s classification and risk in accessing a resource hosted on it Mail Security – upload an email for scanning against malware and phishing attacks, based on award winning Sandblast engines All APIs are RESTful, simple to use and can be integrated as part of a SOAR application, home-made application and more! If you’re a Check Point customer interested in participating in the early availability stage drop me a mail at yoav@checkpoint.com

inside

2657 2 7

New Unified API Reference

I’m glad to share our new API Reference portal . This site will be “one-stop-shop” for all CP APIs references. Currently we have added Management APIs and Gaia APIs, we are in progress of adding the rest of APIs (SandBlast , TP APIs etc.) Regards, Amiad.