Tags on Rules and Sections?

[Bob_Zimmerman]

Looking at the documentation for management API v1.9, I see tags can be set on access layers, HTTPS layers, policy packages, and NAT sections. Meanwhile, access sections, access rules, HTTPS sections, HTTPS rules, and NAT rules make no mention of them. They all seem to have a tags field internally, but the API documentation only references the field on some of them.

Can tags be set on these objects? If nobody knows, I should be able to try it out tomorrow.

[PhoneBoy]

@Omer_Kleinstern should be able to tell you for sure.

[Tal_Paz-Fridman]

I would also recommend looking at the 3 Custom fields:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/set-access-rule~v1.9%20

[Bob_Zimmerman]

Sure. I'm not trying to solve any particular problem, I'm just trying to learn what is possible and what isn't. I'm building something to interact with the API, and I'm trying to include local checks so the user can't even try to do things which the API simply doesn't allow. If tags on rules aren't a thing, then I simply won't let the user specify tags to set.

Also I was apparently reading some of the return values on NAT sections. They return a list of tags, but the documentation doesn't have a way to set the tags. Access sections and HTTPS sections also return a list of tags, but don't appear to have a way to set them (outside of 'set generic-object', anyway). The various rule types don't return a list of tags at all.

These little inconsistencies are driving me nuts. 😜 Most things have a comments field and a name field. Rule sections of any kind don't accept comments, but they have names. NAT rules don't have a name, but they have comments. This has led me to try to find all of the inconsistencies I can so I can handle them properly.

[Tomer_Noy]

We don't currently support tags on Access rules, but we are looking at it for upcoming versions.

[Bob_Zimmerman]

Thanks for the confirmation! That's what I was expecting. I assume it's the case for other rule types, too.

[Omer_Kleinstern]

We will support tags on all rule types in the next version and in future HFA of previous versions.

[faridb]

Hi Omer,

it seems we do not support it yet , right ?

Farid

[Omer_Kleinstern · Accepted solution]

Supported in Management API since R81.20 HFA take 26 (PMTR-89420)

[faridb]

thx for confirming !

so it's not possible to leverage these tags on smartconsole for simple actions like search all rules matching a specific tag ?

[PhoneBoy]

You can search for objects tagged with a specific tag in SmartConsole.
However, this search does not currently look at the rules themselves for tags. 
As SmartConsole (at least in R81.20), doesn't support tagging a rule, I used SmartConsole CLI to tag the Stealth rule with the tag "Foobar"
You can see that I successfully did it by reviewing the API output:

I also tagged HR LAN with Foobar and did a search in SmartConsole:

As you can see, rules 3 and 8 (which include an object tagged with Foobar) show.
Rule 2 (where I applied the Foobar tag on the rule itself) does not show in the search.

Not sure if this is a bug or an RFE.