I have an issue with my Check Point management environment, which is related to the tagging possibilities and logic. The management server itself is running R80.40, but I think that this does not matter as I have read the docs regarding further releases and related management API versions. So to begin...
The environment is kinda large with lots of administrators who perform daily tasks. Not of all the tasks are automated, so manual creation of specific objects and rules is necessary. In regards to tags we have a model where each resource needs to be tagged in way that makes sense, so that the tags can be used to build a logical connection relatedto internal departments/applications etc. Now to the actual issue:
If someone enters a tag like "Tagname:XYZ" and instantly presses enter, the SmartConsole application creates a new tag, even though there may already be an existing one with exactly the same name. (When you enter a tag name within another object, like for example a host.) This leads to the fact that we have lots of tags with the same name but different UIDs (as they are technically different objects). [I know, that a dropdown for given tags gets displayed when you enter a tag name without instantly pressing enter.]
This behaviour raises the following questions:
> Is there some way to restrict permissions of users / groups within the SmartConsole to specific API calls, so that some admins can only select tags for new resources without the chance to create new tags (which would basically eliminate the described problem)? A first lookup in the permission profile section of the SmartConsole did not list such a granular option.
> Due to the current "tagging chaos" I am currently trying to find a way to sort this out by removing identical tag names and alter respective tagged resources/objects. During a first evaluation I realized, that the api call for "where-used" can not be used on tags, while the SmartConsole provides such an option (via Manage & Settings => Tags => Where Used ... [in the top bar]). When I try to perform the where-used api operation with an UID that belongs to a tag the API responds that the object could not be found. (A "show object uid xyz" with the same uid can be executed successfully.)
Thanks in advance for any replies!