API Policy Install

[Simon_Macpherso]

Hello,

Management API Reference v1.8.1 states for the policy -> install-policy endpoint, the argument parameter 'targets' is a required argument.

I have tested this requirement and it seems the 'targets' argument parameter is not required. This was tested on the following environments -Management R81.10 JHF baseline (API version 1.8) -Management R81.10 JHF take 79 (API version 1.8.1)

If the following example command is run, the "standard" policy is installed on ALL gateways, including gateways where "Specified Gateways" for installation targets is configured and a gateway is specified.

mgmt_cli install-policy policy-package "standard" access true --format json 

My understanding if required arguments are they are just that. If the required argument is not entered, the command should fail with reason "Missing parameter: [targets]. This would be the expected result for a required argument. Just as 'policy-package' is a required argument - if the 'policy-package' argument parameter is not included in the command, the command fails with reason "Missing parameter: [policy-package].

After discovering the command did not fail if a target was not specified, I thought the policy might only be installed on all gateways where the installation target setting was set to 'All Gateways'. However as mentioned above the policy is installed on ALL gateways, regardless of the current installation target setting on the policy.

This seems like a bug and there should be a safety net for this feature.

I want to specify a specific target, but we also need it to prompt or fail and return "Missing parameter: [targets] if a target is not specified.  Ensuring the "targets" argument parameter is a required argument will prevent a specific policy package being installed on unintended gateways.

Regards,

Simon

[Tal_Paz-Fridman]

Hi

When I run the command without specifying the policy targets it only install on the targets as specified on the Policy Package.

Do you experience a different behavior?

[Simon_Macpherso]

Hi @Tal_Paz-Fridman,

What you described above is correct and expected. 

When I run the command without specifying a policy target, if the installation target is set to 'All gateways', the policy installs on all gateways, including on gateways that are configured as targets in another other policies.  I expected the policy would only be installed on gateways that weren't already configured as targets.  So to avoid this you must specify the intended installation targets for the policy you are installing, otherwise you may deploy the policy to all gateways across your estate. 

Regards,

Simon   

[PhoneBoy]

Looks like a documentation bug.
Paging @Omer_Kleinstern 

v1.9 says that targets isn't required (earlier versions list it as required).
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/install-policy~v1.9%20 

[Omer_Kleinstern · Accepted solution]

I confirm that this is a documentation issue and @Tal_Paz-Fridman is correct.

When you run the command without specifying the policy targets it will only install on the targets as specified on the Policy Package.