Publish API query

[appyens]

Do I need to call publish API after every change in one session or I can publish changes all at once with final publish API call in one session?

[_Val_]

It is enough to publish before logging off, or every time you need those changes to be available for other admins.

[_Val_]

In general, always follow the flow:

1. login and capture sid

2. perform changes

3. verify performed changes

4. publish or discard, depending of the results in p.3

5. log off

[PhoneBoy]

If you're doing a small number of changes, then publishing after you do the API calls to make them is fine.
If you're doing a large number of changes (several hundred), it's best to publish after every few hundred calls for performance reasons.

Note that publish does NOT push changes to the relevant security gateways for enforcement.
That is done with a separate policy installation action.

[appyens]

Thanks for the replay. How can I push changes to security gateways for enforcement with API. please explain

[PhoneBoy]

You use the install-policy API.
https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/install-policy~v1.6

[appyens]

I have checked it. the policy-package and target are required fields. what is policy package name and where can I find it, is there any API command for it? target is the name of gateway right?

[PhoneBoy]

Target is the name of the gateway, yes.

The layer itself won't tell you what policy package its used in as it can exist as part of multiple policy packages.
If you were to do it programmatically, you would have to list all policy packages (show-packages) and listing each package (show-package) to determine what layers are used within them.
The other option is to know via some other method which policy package(s) you're pushing beforehand.

In any case, only one install-policy action can be active at one time, so if you're updating multiple policies programmatically, you'd have to push one policy, wait until it finishes, then push the next policy, etc.