R80.20 Script Needed to Perform Bulk Find and Replace

[John_Madigan]

I have an R80.20 Management Server and a requirement to replace existing network objects with R80.20 wildcard objects where ever the old objects are referenced in the rulebase. There are approximately 60 objects, with > 1000 references in the existing rulebase.

Prior to R80.x I would have used sed to perform a global find and replace on the rulebases_5_0.fws file, however now I am looking for a way to achieve this using mgmt_cli or a script to perform a find and replace.

[Joshua_Hatter]

SmartConsole where-used menu has a replace option that can probably accomplish what you want.

[Wes_Belt]

John Madigan‌ and I are working together on this.

We have to update/replace 55 objects across all the rules in a policy, so while we could do it manually in SmartConsole GUI with the where-used / replace function we decided it was a good opportunity to script a solution in Python using the R80 APIs.  We are basically going to use the API where-used to find the rules that need to be updated then use set-access-rule to make the replacements/updates we need from there.

[Joshua_Hatter]

Seems like you got it figured out, was there a question?

R&D wrote a full blown wrapper in Python2 on GitHub, and I posted one on GitHub as well in Python3, also available here on check mates. 

Let us know if you have any questions.

[Wes_Belt]

Yeah no questions as of yet, so far it is all working.  I looked at the github wrapper briefly but had experience using the python (2.7) requests library so just built the script around that.  We wanted to get something up and running quickly, but I will revisit the github wrappers at some point in the future.

Will be sure to reach out if we run into any issues but the API documentation is excellent and so far everything going as expected!

[Wes_Belt]

We were able to get a script working for our conversion.  It is a single use case script (don't see a lot of reuse potential) but I shared it on github anyhow just to experiment more with git and github 

GitHub - chkp-wbelt/convert-wildcard: Check Point management API script to migrate R77.30 wildcard o... 

[Paul_Gademsky]

Do you have the links for the wrappers?

Thank you, 
Paul G. CCSM

[Joshua_Hatter]

The wrapper written by Check Point development now also supports Python3! 

GitHub - CheckPointSW/cp_mgmt_api_python_sdk: Check Point API Python Development Kit 

[Wes_Belt]

We updated this script (on github link above) to use the official API.  Biggest benefits from my perspective were the built in functionality for wait_for_task on the publish and dealing with the signature and low level HTTP stuff, which was all custom code in the prior script.  I haven't tested pip install with git link yet, but that would be the nice thing we would add just for ease of use an experience.

[Paul_Gademsky]

I have a similar question to this.

I have tcp and udp services that were imported using confwiz under R77.30 from Cisco ASA's and named by the wizard, so I have multiples of the same service (i.e. hydro_UDP_Service_80, chep_UDP_Service_80 (some have about 13 iterations). They are used in a variety of policies and groups.

The goal is to change one of the existing service names to UDP_Service_80, and then do a where_used on the remainder and replace them in the found objects with the renamed service, and then delete the unused service objects.

Currently, I'm working on manually doing the UDP services from SmartConsole, and have made my way through 100 objects so far (tedious, but it works) using object explorer.  The down side is that the UDP objects to be changed is ~1300, and the tcp is around 3,500. Hence the need for the scripting.

I have postman running on a test system to try to make these changes, but based on the above, it sounds that it might be more like a python job?

I did see from the CPX presentation by Marco, that they were planning on being able to capture user actions to make scripts, any progress on that (as it might be useful here?

Paul G, CCSM