- Products
- Learn
- Local User Groups
- Partners
-
More
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
IDC Spotlight -
Uplevel The SOC
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Scripting gurus, should one of you have a chance, please help with the script for identification and deletion of the automatically created network objects.
These are created based on topology of the gateways and/or static routes.
When "get interfaces with topology" is executed or when newly deployed gateway objects with static routes are created, number of networks starting with "Net_" are created that is impossible to delete from SmartConsole, but are present and visible in the group membership selection window.
I suspect that the script to identify and remove those will be welcome, especially if it could differentiate between automatically created objects and those defined manually or via scripts, even if using same prefix.
Thank you,
Vladimir
They are kept there for revision rollbacks so probably not too smart to delete them.. But otherwise you would have to use dbedit commands as API does not show "hidden" networks created by automatic topology process. If you look at this bit "cdm_auto_calculated", true will hide the object from being visible in console / API
you can list all the "invisible" networks that are not used in any groups using this one-liner
names=($(echo -e "query network_objects,cdm_auto_calculated='true'\n-q\n" | dbedit -local | grep "Object Name:" | sed 's/Object Name: //')); for name in "${names[@]}"; do if [ `echo -e "whereused network_objects $name\n-q\n" | dbedit -local | grep -c "Numebr of results: 0"` -eq 1 ] && [ `echo -e "print network_objects $name\n-q\n" | dbedit -local | grep -c "type: group"` -eq 0 ]; then echo $name; fi; done
It will be fairly slow as it's running dbedit commands. To delete you will have to replace last echo used to print out with
echo -e "delete network_objects $name\n-q\n" | dbedit -local
I would not run it in production without lab testing. Worked OK on some CMAs that i tried on
They are kept there for revision rollbacks so probably not too smart to delete them.. But otherwise you would have to use dbedit commands as API does not show "hidden" networks created by automatic topology process. If you look at this bit "cdm_auto_calculated", true will hide the object from being visible in console / API
you can list all the "invisible" networks that are not used in any groups using this one-liner
names=($(echo -e "query network_objects,cdm_auto_calculated='true'\n-q\n" | dbedit -local | grep "Object Name:" | sed 's/Object Name: //')); for name in "${names[@]}"; do if [ `echo -e "whereused network_objects $name\n-q\n" | dbedit -local | grep -c "Numebr of results: 0"` -eq 1 ] && [ `echo -e "print network_objects $name\n-q\n" | dbedit -local | grep -c "type: group"` -eq 0 ]; then echo $name; fi; done
It will be fairly slow as it's running dbedit commands. To delete you will have to replace last echo used to print out with
echo -e "delete network_objects $name\n-q\n" | dbedit -local
I would not run it in production without lab testing. Worked OK on some CMAs that i tried on
Jeez, Kaspars, that one-liner wouldn't fit in a twitter post
Dameon Welch-Abernathy claims that these objects could be deleted via API. I'd like to hear from him if the deletion requires manual definition of the objects or if 1.3 allows us to pull those out and feed them into delete object.
Could be. I only looked at 1.1 / R80.10 and that did not show those objects.
I was able to do it in R80.10 from the CLI, (and thus the API) as I recall.
Haven't seen the issue again to validate.
100% correct - it was only Console that hides some nets, not API. So I can take my words back
Whereas API and dbedit return two extra
But it is visible in the group it's used in Console
Is this a Console bug Dameon? I know it worked OK in R77.30
I guess the only limitation with API is that we cannot see if network was created by topology generation process:
compare to dbedit:
Hi Vladimir,
I'd like to refer you to sk126872 id you have not read it yet. It is important to understand why these objects are exist and make sure you do not use them before you delete them.
You can contact Check Point support in order to get this done.
Ari
Thank you Ari Heber. Unfortunately, these objects are being created not only when you perform "Get Interfaces with Topology" , but as I have described earlier, also during creation of the gateway objects with static routes already pre-provisioned.
These network objects are conflicting with scripted ingestion of the actual network objects with intended properties defined.
What I would like to know is that if it is safe to delete those using Kaspar's suggested one-liner if they are NOT used in the topologies of the gateways (i.e. topology of each was re-defined manually with custom groups containing manually created networks).
In a situation where multiple gateways destined for different sites, it is necessary to provision them with routes allowing communication with the management server.
Changing their properties individually via GuiDBedit is not really a viable option.
Regards,
Vladimir
Hi Vladimir,
These 2 flows are actually the same flow; when initializing a SIC with remote gateway the interfaces and the routes are fetched automatically by the management (same as in Get Interfaces With Topology).
Using the one-liner command is quite safe, the operation will fail if the object is used by an interface.
Ari
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY