Block ip address using api rest

[ottis79]

Hi all

It is possibile to create a rule to block a list of ips using the api rest (Web Service)?  

I'm using checkpoint R80.40.

Thanks

[Jonas_Rosenboom]

Have a look here: https://community.checkpoint.com/t5/API-CLI-Discussion/Blocking-TOR-exit-nodes-with-Python-and-R80-1...

The thread contains an example to manage blocklists in the rule-base, as well as providing information on other, possibly better options.

Depending on your exact use case, Custom Intelligence Feeds may also be a great solution.

[ottis79]

Hi Jonas

Thanks for your support.

One question: the script in the first link add a group in an existing rule (a block rule)?

Ottavio

[Jonas_Rosenboom]

The script in the first link adds hosts to an existing group. It allows you to use a single rule at a convenient place in your rulebase. However, please take into account other options for blocking lists of IPs, most of the other solutions are better at scale and from operational efforts. 

[ottis79]

Hi Jonas, thanks for your explanation.

I have a small question, I'm agree with you that the solution with rest api to create a large number of IPs is not performance way, but in my case the IPs number is very small, Can you help me to understand the api rest with steps to create a rule to block the ip? 

many thanks

Ottavio

[Jonas_Rosenboom · Accepted solution]

You can find the full documentation of our API at https://sc1.checkpoint.com/documents/latest/APIs/index.html

To create a rule blocking a group of IPs take a look at these API commands:

	add-group name "ExampleGroup_BlockIps"
	add-host name "Block_203.0.113.11" ip-address "203.0.113.11" groups "ExampleGroup_BlockIps"
	add-access-rule layer "Network" position "top" source "ExampleGroup_BlockIps"

Feel free to try these out in SmartConsole demo mode!

BTW:
If you are interesting in a comprehensive training, we offer course and certification focused on automating tasks with the API:

Check Point Certified Automation Specialist (CCAS) 

[ottis79]

Hi Jonas

Many thanks for your help, I will try with your indications.

Is it possible to use add-object-batch with property "group" to create a list number of IPs instead send many add-host request? 

[Bob_Zimmerman]

I think it's worth mentioning Check Point's management API is not REST-based. If you plan to do this with a client built to make calls to arbitrary REST APIs, it won't work.

The easiest way to make calls to Check Point's API is with mgmt_cli directly on the management server. To work remotely, you will need a way to work with JSON and a way to make HTTP POST requests (cURL works).