Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
ottis79
Explorer

Block ip address using api rest

Jump to solution

Hi all

 

It is possibile to create a rule to block a list of ips using the api rest (Web Service)?  

 

I'm using checkpoint R80.40.

 

Thanks

0 Kudos
1 Solution

Accepted Solutions
Jonas_Rosenboom
Employee
Employee

You can find the full documentation of our API at https://sc1.checkpoint.com/documents/latest/APIs/index.html

To create a rule blocking a group of IPs take a look at these API commands:

	add-group name "ExampleGroup_BlockIps"
	add-host name "Block_203.0.113.11" ip-address "203.0.113.11" groups "ExampleGroup_BlockIps"
	add-access-rule layer "Network" position "top" source "ExampleGroup_BlockIps"

Feel free to try these out in SmartConsole demo mode!

BTW:
If you are interesting in a comprehensive training, we offer course and certification focused on automating tasks with the API:

Check Point Certified Automation Specialist (CCAS) 

View solution in original post

0 Kudos
7 Replies
Jonas_Rosenboom
Employee
Employee

Have a look here: https://community.checkpoint.com/t5/API-CLI-Discussion/Blocking-TOR-exit-nodes-with-Python-and-R80-1...

The thread contains an example to manage blocklists in the rule-base, as well as providing information on other, possibly better options.

Depending on your exact use case, Custom Intelligence Feeds may also be a great solution.

(1)
ottis79
Explorer

Hi Jonas

 

Thanks for your support.

One question: the script in the first link add a group in an existing rule (a block rule)?

Ottavio

0 Kudos
Jonas_Rosenboom
Employee
Employee

The script in the first link adds hosts to an existing group. It allows you to use a single rule at a convenient place in your rulebase. However, please take into account other options for blocking lists of IPs, most of the other solutions are better at scale and from operational efforts. 

0 Kudos
ottis79
Explorer

Hi Jonas, thanks for your explanation.

I have a small question, I'm agree with you that the solution with rest api to create a large number of IPs is not performance way, but in my case the IPs number is very small, Can you help me to understand the api rest with steps to create a rule to block the ip? 

 

many thanks

Ottavio

0 Kudos
Jonas_Rosenboom
Employee
Employee

You can find the full documentation of our API at https://sc1.checkpoint.com/documents/latest/APIs/index.html

To create a rule blocking a group of IPs take a look at these API commands:

	add-group name "ExampleGroup_BlockIps"
	add-host name "Block_203.0.113.11" ip-address "203.0.113.11" groups "ExampleGroup_BlockIps"
	add-access-rule layer "Network" position "top" source "ExampleGroup_BlockIps"

Feel free to try these out in SmartConsole demo mode!

BTW:
If you are interesting in a comprehensive training, we offer course and certification focused on automating tasks with the API:

Check Point Certified Automation Specialist (CCAS) 

View solution in original post

0 Kudos
ottis79
Explorer

Hi Jonas

Many thanks for your help, I will try with your indications.

Is it possible to use add-object-batch with property "group" to create a list number of IPs instead send many add-host request? 

 

0 Kudos
Bob_Zimmerman
Advisor

I think it's worth mentioning Check Point's management API is not REST-based. If you plan to do this with a client built to make calls to arbitrary REST APIs, it won't work.

The easiest way to make calls to Check Point's API is with mgmt_cli directly on the management server. To work remotely, you will need a way to work with JSON and a way to make HTTP POST requests (cURL works).

0 Kudos