Hello everyone,
My ultimate goal is to allow for the initial and ongoing configuration of core security and networking components, including checkpoint systems via Terraform. Elements of particular interest to be managed would include network and routing components like: vpnt interfaces, bgp routing setup, bgp route-maps, inbound and outbound bgp ACL groups as well as items managed by the Checkpoint policy server, like VPN communities, network topologies, foreign VPN devices, etc.
Usage would include the initial setup (this is less critical as this can be done less elegantly with initial dynamic scripts), but also more importantly the ongoing maintenance using standard CRUD operations on these type of objects which I suspect will be much harder to accomplish this way. Ideally this can be accomplished in a more declaritive fashion versus imperative which would require all kinds of code to be introduced to check current state, what changes are really necessary, etc.
I'm aware and have reviewed the existing cloudformation templates, including Checkpoint WAN/VPC Transport automation. I've also gone through the bash and python scripts. I'm aware of the management APIs, but many of the objects I want to manipulate are not manageable from the central policy server.
Now for all the questions to Checkpoint and any users who may have made any progress in the area on their own:
Is there a roadmap to create a terraform provider for the management server? One or more significant competitors have.
Is there a roadmap for filling the management gap for all the items still configured directly on the firewalls and not maintained by the management server (i.e. all the cli.sh type stuff, I'm immediately interested in the networking/routing stack)? Is there a reason this cannot be retained and managed by a structure in the central management database?
Has anyone made any headway in this area and would care to share successes and failures?
