Check Point REST API show-objects performance issue with 25k objects (pagination limit)

[Sivaramakrishna]

I am querying object details using the Check Point REST API. The API returns only 500 objects per request and requires offset-based pagination.

My environment has approximately 25,000 objects. Fetching all objects becomes tedious and time-consuming due to the pagination limitation and the fact that API requests are executed sequentially to retrieve the full dataset.

This is part of an automated rules and objects analyzer, so performance is critical.

Questions:

1. Is there an asynchronous option available for show-objects?

2. Can the limit parameter be increased safely beyond 500?

3. Are there any recommended best practices for querying large object databases via the Management API?

Any guidance from Check Point experts would be appreciated.

##ManagementAPI #REST_API #SecurityManagement #Performanc

[PhoneBoy]

As far as I know:

• There is no async option for show-objects
• You can increase the limit beyond 500 (the backend didn't block it last I checked), but there is no guarantee you will get more than 500 objects. 

From a performance perspective, you might be better off doing more queries with smaller amounts of objects.
However, I haven't tested that.

[Bob_Zimmerman]

The management API definitely rejects a limit over 500. This management is R82 jumbo 60:

[Expert@DallasSC]# mgmt_cli -f json -r true show application-sites limit 1000 details-level uid              
{
  "code" : "generic_err_invalid_parameter",
  "message" : "Invalid parameter for [limit]. The invalid value [1000] should be replaced by one of the following values: [1-500]"
}

For my clients, I just dump all the objects up front, then work with a local copy of the whole object list. It takes a few minutes, but it's worth it to not have to make calls when browsing data.

For analyzing rules in particular, the objects-dictionary key contains the objects directly referenced in the rules returned by the call. I seem to remember some built-in objects (like "Any", "None", "Original", "Accept", "Drop", etc.) weren't always included, but they seem to be there in R82.

[Vincent_Bacher]

We as well have many objects and i would use this approach as well to dump all objects using a cron job and then use this objects in other scripts.

[PhoneBoy]

The actual enforcement of the upper limit must have been added since the last time I checked it...which was a while ago, probably 🙂
I agree that working with a local cache of the objects (versus continually using API calls) is probably faster.

[Don_Paterson]

Can you share the commands that you are using?

It's about understanding if you are using the best methods for interacting with the management API and the best options (switches)  

Did you check the best practices documents?

https://sc1.checkpoint.com/documents/latest/APIs/#tips_best_practices~v2.1%20

https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-host~v2.1%20

https://sc1.checkpoint.com/documents/latest/APIs/#cli/show-hosts~v2.1%20