R80.10 Add Access-Rule using RESTAPI on policy package

[Chandhrasekar_S]

All,

I want to add an access-rule on a specific policy package using REST API on R80.10 management server

I went through the below url, however I don't see, which policy package this rule will be placed in. I have multiple policy packages and want the access-rule to be placed in the right package

https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/add-access-rule~v1.1

[Ron_Izraeli]

Hi Chandhrasekar,

access-rule is contained in an access-layer therefore, add-access-rule API command require an access-layer name/uid as parameter.

You could use where-used API command with layer name/uid as parameter to figure out in which policies this layer is being used before/after adding an access-rule.

Would it answer your requirement?

[Chandhrasekar_S]

Thanks very much Ron for the reply. It explains

[Chandhrasekar_S]

Thanks Ron. I was successfully able to create access-rule using REST API and specifying "layer" name placed the rule under correct policy package

however I am facing a different issue now. I was curious, and want to find out the result of "where-used". The output shows only the following "@{used-directly=} . It doesn't provide any more info on the policy , objects, rule , uid etc

I am using power shell to execute my scripts. do you happen to know why I am not getting a detailed result with all the parameters

@{used-directly=}

[Tomer_Sole]

the used-directly output value should provide a list of usages. In the case of an objects used in an access control rule, it should specify the rule, layer and policy. If this is not the case, can you provide your request and response syntax here?

[Chandhrasekar_S]

Hi Tomer,

Code below

# Ignore SSL cert Exception

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

# Login to Management server and obtain sid

$URL = "https://xx.xx.xx.xx/web_api"
$Action = "/login"
$URLAnon = "$URL$Action"

$headers = @{    "Content-Type" = "application/json"
    }

$login = @{
      "user" = "admin"
      "password" = "YYYYYYYYY"
    }

$login = $login | ConvertTo-Json

$response = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $login

$sid = $response.sid

# Where-Used

$Action = "/where-used"
$URLAnon = "$URL$Action"

$headers = @{
    "Content-Type" = "application/json"
    "X-chkp-sid" = $sid
    }

$WhereUsed = @{
 
  "name" = "MY-WEBSERVERS"

}

$WhereUsed = $WhereUsed | ConvertTo-Json

$result = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $WhereUsed

#$result = $result | Convert-To-Json

Write-Host $result

[Tomer_Sole]

thanks, what was the output in this case?

[Chandhrasekar_S]

Below is the output I got

@{used-directly=}

[Tomer_Sole]

Are you sure that this host object is placed in the source or the destination of one of your rules? Perhaps it's inside a group inside that rule? If that is the case, you will need to add "indirect: true" to your request and receive indirect usages.

[Robert_Decker]

In addition to Tomer's answer, the "indirect-max-depth" field (default is 5) determines the maximum nesting level during indirect usage search.

Robert.

[Chandhrasekar_S]

Can you please let me know, where do I change the "indirect-max-depth" field .Thanks!

[Chandhrasekar_S]

I did change the indirect-max-depth field to 250 to the REST API body I send, but the powershell output is still the same

$WhereUsed = @{

"name" = "xxxxssss-SERVERS"

"indirect-max-depth" = 250

}

[Chandhrasekar_S]

The Group Object is being used in a access-rule and the output does display correctly

@{used-directly=}

The problem is, I am not able to view all the parameters.

[Robert_Decker]

[Chandhrasekar_S]

Hello,

I did try sending 'details-level' in my powershell code. I got the same result

I modified the powershell result to result.'used-directly'  now I am getting total but still other output aren't visible

My new output. I still couldn't see whether its used in objects or access-control-rules.

I don't know if this is checkpoint issue or power shell issue. If any one familiar with Power shell, can you please check my code and help.

@{total=1; objects=System.Object[]; threat-prevention-rules=System.Object[]; nat-rules=System.Object[]; access-control-rules=System.Obj

ect[]}

======================================

# Ignore SSL cert Exception

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

# Login to Management server and obtain sid

　

$URL = "https://xx.xx.xx.xx/web_api"

$Action = "/login"

$URLAnon = "$URL$Action"

$headers = @{ "Content-Type" = "application/json"

}

$login = @{

"user" = "admin"

"password" = "yyyyy"

}

$login = $login | ConvertTo-Json

$response = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $login

$sid = $response.sid

　

# Where-Used

　

$Action = "/where-used"

$URLAnon = "$URL$Action"

$headers = @{

"Content-Type" = "application/json"

"X-chkp-sid" = $sid

}

$WhereUsed = @{

"name" = "MY-HOST"

}

$WhereUsed = $WhereUsed | ConvertTo-Json

　

$result = Invoke-RestMethod -Method Post -Headers $headers -Uri $URLAnon -Body $WhereUsed

　

Write-Host $result.'used-directly'

======================================

[Robert_Decker]

Hi,

In order to verify whether this is checkpoint issue or power shell issue, try running the command directly on the management server using mgmt_cli utility and examine the results - 

https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/where-used~v1.1

Refer to the examples at the bottom of the page.

Robert.

[Chandhrasekar_S]

Thank you Robert! I was able to use mgmt_cli utility and get the UID and Name of the layer and can now create the access-rule using REST API. I wish I can get them using my power shell code itself, it would enable me to do end to end automation and orchestration...

[Robert_Decker]

Try changing the title of this post to something like - "R80.10 Add Access-Rule using RESTAPI and PowerShell", so that Power Shell experts can notice and assist.

Robert.

[Robert_Decker]

In addition, read this thread, maybe you will find it useful - 

https://community.checkpoint.com/thread/5684-web-api-issues-with-run-script-and-install-policy-from-... 

Robert.