Mgmt CLI - show gateways-and-servers - object "type" values?

[sorinstf]

Hello, 

I had a script on R80.40 used to pull a list of individual gateways and cluster members using mgmt_cli and save it as a txt file. 

After migration to R81.20 I only get the Simple Gateways, without cluster members. 

"select(.type == "simple-gateway" or .type == "CpmiClusterMember")"

Management API Reference  v1.9   - "show gateways-and-servers "does not provide string values for "type".

Any idea where I can get a list of values for "object type"?

Thanks!

[Amir_Senn · Accepted solution]

I see in my lab that cluster members have returned type:"cluster-member".

Maybe try to edit the script to: "select(.type == "simple-gateway" or .type == "CpmiClusterMember" or .type == "cluster-member")" and see if it solves the issue?

[sorinstf]

Hello, 

that's exactly what I chose after digging into thousands of lines of code 🙂 

mgmt_cli -f json -r true show gateways-and-servers details-level full limit 500

Regards, 

Sorin

[Bob_Zimmerman · Accepted solution]

Looks like the type is now "cluster-member". Here's some output from one of my managements with a few normal clusters and a few VSX clusters:

[Expert@SomeSmartCenter]# mgmt_cli -f json -r true show gateways-and-servers details-level full limit 500 | jq '.objects[]|.type' | sort | uniq -c
      6 "CpmiGatewayCluster"
      5 "CpmiVsClusterNetobj"
      6 "CpmiVsxClusterMember"
      3 "CpmiVsxClusterNetobj"
      3 "checkpoint-host"
     12 "cluster-member"

[sorinstf]

Excellent! Many thanks for your reply!

[Matlu]

Hello, @Bob_Zimmerman 
Is it possible to “display” the Gateways and Servers that are within a particular CMA in an MDS environment?
I am logging into my MDS, jumping to my CMA, and I want to apply a command that shows me “only” the “Gateways and Servers” that correspond to that CMA.
Is this possible?
Cheers.

[Bob_Zimmerman]

Just the names? Sure. Replace "<domain>" with the name of the domain:

mgmt_cli -f json -r true -d <domain> show gateways-and-servers limit 500 | jq '.objects[]|.name'

[Matlu]

Does this apply from the main MDS without ‘jumping’ to the CMA? Or do I have to jump to the CMA?

What I need is that by CLI I may be able to see the list of ‘objects’ that you see when you enter through the SmartConsole in the GATEWAYS AND SERVERS section.

Thanks for your comments

[Matlu]

Hello,
I tried it, but I don't see any results.
I run the command from the MDS without success.

[Expert@MDS:0]#
[Expert@MDS:0]# mgmt_cli -f json -r true -d DOM_GO show gateways-and-servers limit 500 | jq '.objects[]|.name'
Error: Failed to login to the management server
[Expert@MDS:0]# ^C
[Expert@MDS:0]# timed out waiting for input: auto-logout

My CMA is called DOM_GO
We are interested in being able to see which devices this CMA manages from the MDS CLI.

[PhoneBoy]

The underlying API call is failing.
What does api status say?

[Bob_Zimmerman]

Try this. It will give you the valid domains on the server:

mgmt_cli -f json -r true show domains | jq '.objects[]|.name'

[Matlu]

The command shows me results.
So why can't the other command show me the objects that CMA is managing?

[Expert@MDS:0]#
[Expert@MDS:0]# mgmt_cli -f json -r true show domains | jq '.objects[]|.name'
"DOM_XX"
"DOM_YY"
"DOM_GO"
"DOM_SO"
[Expert@MDS:0]#
[Expert@MDS:0]# api status

API Settings:
---------------------
Accessibility: Require all granted
Automatic Start: Enabled

Processes:

Name State PID More Information
-------------------------------------------------
API Started 14544
CPM Started 14544 Check Point Security Management Server is running and ready
FWM Started 52017
APACHE Started 10741

Port Details:
-------------------
JETTY Internal Port: 55836
JETTY Documentation Internal Port: 54910
APACHE Gaia Port: 443

Profile:
-------------------
Machine profile: 131072 or larger without SME - MDS
CPM heap size: 20480m

Apache port retrieved from: dbget http:ssl_port

--------------------------------------------
Overall API Status: Started
--------------------------------------------

API readiness test SUCCESSFUL. The server is up and ready to receive connections

Notes:
------------
To collect troubleshooting data, please run 'api status -s <comment>'

[Expert@MDS:0]#

Am I missing something?

[PhoneBoy]

Ok, I think I see why mgmt_cli -f json -r true -d DOM_GO show gateways-and-servers limit 500 | jq '.objects[]|.name' is failing.
Specifically, not sure you can use -r true with MDS and a domain.

[Bob_Zimmerman]

I use it all the time, including in my onEachFirewall script.

There are a number of things which can break API access. Maybe it has been disabled for the domain, or restricted to only certain addresses and localhost isn’t one of them.

[PhoneBoy]

This is probably a good time to remind folks that the API is versioned.
This means that even though you've upgraded to a new release, you can call the old version of the API...and get results that are consistent with that version.
The API version that I believe maps to R80.40 is v1.7.
See: https://sc1.checkpoint.com/documents/latest/APIs/index.html#api_versions~v1.9%20 

[sorinstf]

Hello, 

yes,  you are right! You can still reference to your initial API version in the API command.. I found out about it after chaning the script object type. This is where I was not able to find all the string values of the object...  

[--version, -v]
What command version should be called. By default the latest version is used.

[Expert@mds-prod-8040:0]# mgmt_cli -r true show api-versions
current-version: "1.6.1"

[PhoneBoy]

Yeah 1.6.1 is R80.40 JHF, 1.7 is R81.