- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
Check Point's Cyber Park is Now Open
Let the Games Begin!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi all
It is possibile to create a rule to block a list of ips using the api rest (Web Service)?
I'm using checkpoint R80.40.
Thanks
You can find the full documentation of our API at https://sc1.checkpoint.com/documents/latest/APIs/index.html
To create a rule blocking a group of IPs take a look at these API commands:
add-group name "ExampleGroup_BlockIps"
add-host name "Block_203.0.113.11" ip-address "203.0.113.11" groups "ExampleGroup_BlockIps"
add-access-rule layer "Network" position "top" source "ExampleGroup_BlockIps"
Feel free to try these out in SmartConsole demo mode!
BTW:
If you are interesting in a comprehensive training, we offer course and certification focused on automating tasks with the API:
Have a look here: https://community.checkpoint.com/t5/API-CLI-Discussion/Blocking-TOR-exit-nodes-with-Python-and-R80-1...
The thread contains an example to manage blocklists in the rule-base, as well as providing information on other, possibly better options.
Depending on your exact use case, Custom Intelligence Feeds may also be a great solution.
Hi Jonas
Thanks for your support.
One question: the script in the first link add a group in an existing rule (a block rule)?
Ottavio
The script in the first link adds hosts to an existing group. It allows you to use a single rule at a convenient place in your rulebase. However, please take into account other options for blocking lists of IPs, most of the other solutions are better at scale and from operational efforts.
Hi Jonas, thanks for your explanation.
I have a small question, I'm agree with you that the solution with rest api to create a large number of IPs is not performance way, but in my case the IPs number is very small, Can you help me to understand the api rest with steps to create a rule to block the ip?
many thanks
Ottavio
You can find the full documentation of our API at https://sc1.checkpoint.com/documents/latest/APIs/index.html
To create a rule blocking a group of IPs take a look at these API commands:
add-group name "ExampleGroup_BlockIps"
add-host name "Block_203.0.113.11" ip-address "203.0.113.11" groups "ExampleGroup_BlockIps"
add-access-rule layer "Network" position "top" source "ExampleGroup_BlockIps"
Feel free to try these out in SmartConsole demo mode!
BTW:
If you are interesting in a comprehensive training, we offer course and certification focused on automating tasks with the API:
Hi Jonas
Many thanks for your help, I will try with your indications.
Is it possible to use add-object-batch with property "group" to create a list number of IPs instead send many add-host request?
I think it's worth mentioning Check Point's management API is not REST-based. If you plan to do this with a client built to make calls to arbitrary REST APIs, it won't work.
The easiest way to make calls to Check Point's API is with mgmt_cli directly on the management server. To work remotely, you will need a way to work with JSON and a way to make HTTP POST requests (cURL works).
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY