Can someone put together a script to delete automatically created networks?

[Vladimir]

Scripting gurus, should one of you have a chance, please help with the script for identification and deletion of the automatically created network objects.

These are created based on topology of the gateways and/or static routes.

When "get interfaces with topology" is executed or when newly deployed gateway objects with static routes are created, number of networks starting with "Net_" are created that is impossible to delete from SmartConsole, but are present and visible in the group membership selection window.

I suspect that the script to identify and remove those will be welcome, especially if it could differentiate between automatically created objects and those defined manually or via scripts, even if using same prefix.

Thank you,

Vladimir

[Kaspars_Zibarts · Accepted solution]

They are kept there for revision rollbacks so probably not too smart to delete them.. But otherwise you would have to use dbedit commands as API does not show "hidden" networks created by automatic topology process. If you look at this bit "cdm_auto_calculated", true will hide the object from being visible in console / API

you can list all the "invisible" networks that are not used in any groups using this one-liner

names=($(echo -e "query network_objects,cdm_auto_calculated='true'\n-q\n" | dbedit -local | grep "Object Name:" | sed 's/Object Name: //')); for name in "${names[@]}"; do if [ `echo -e "whereused network_objects $name\n-q\n" | dbedit -local | grep -c "Numebr of results: 0"` -eq 1 ] && [ `echo -e "print network_objects $name\n-q\n" | dbedit -local | grep -c "type: group"` -eq 0 ]; then echo $name; fi; done

It will be fairly slow as it's running dbedit commands. To delete you will have to replace last echo used to print out with

echo -e "delete network_objects $name\n-q\n" | dbedit -local

I would not run it in production without lab testing. Worked OK on some CMAs that i tried on

[Vladimir]

Jeez, Kaspars, that one-liner wouldn't fit in a twitter post

Dameon Welch-Abernathy claims that these objects could be deleted via API. I'd like to hear from him if the deletion requires manual definition of the objects or if 1.3 allows us to pull those out and feed them into delete object.

[Kaspars_Zibarts]

Could be. I only looked at 1.1 / R80.10 and that did not show those objects.

[PhoneBoy]

I was able to do it in R80.10 from the CLI, (and thus the API) as I recall.

Haven't seen the issue again to validate.

[Kaspars_Zibarts]

100% correct - it was only Console that hides some nets, not API. So I can take my words back

Whereas API and dbedit return two extra

But it is visible in the group it's used in Console

Is this a Console bug Dameon? I know it worked OK in R77.30

[Kaspars_Zibarts]

I guess the only limitation with API is that we cannot see if network was created by topology generation process:

compare to dbedit:

[Ari_Heber]

Hi Vladimir,

I'd like to refer you to sk126872 id you have not read it yet. It is important to understand why these objects are exist and make sure you do not use them before you delete them.

You can contact Check Point support in order to get this done.

Ari

[Vladimir]

Thank you Ari Heber‌. Unfortunately, these objects are being created not only when you perform "Get Interfaces with Topology" , but as I have described earlier, also during creation of the gateway objects with static routes already pre-provisioned.

These network objects are conflicting with scripted ingestion of the actual network objects with intended properties defined.

What I would like to know is that if it is safe to delete those using Kaspar's suggested one-liner if they are NOT used in the topologies of the gateways (i.e. topology of each was re-defined manually with custom groups containing manually created networks).

In a situation where multiple gateways destined for different sites, it is necessary to provision them with routes allowing communication with the management server.

Changing their properties individually via GuiDBedit is not really a viable option.

Regards,

Vladimir

[Ari_Heber]

Hi Vladimir,

These 2 flows are actually the same flow; when initializing a SIC with remote gateway the interfaces and the routes are fetched automatically by the management (same as in Get Interfaces With Topology).

Using the one-liner command is quite safe, the operation will fail if the object is used by an interface.

Ari