VPN tunnel Reset via API

[Kim_Moberg]

Hi

I was thinking if there have been any considerations of inplementing any was to reset vpn tunnel via th mgmt API interface?

Heiko Ankenbrand did provide a great hint to to use vpn tu via commandline.

https://community.checkpoint.com/docs/DOC-3021-show-vpn-routing-on-cli 

Commands are:

vpn tu del ipsec all  

vpn tu del ipsec ip-addr 

vpn tu del ipsec ip-addr username 

vpn tu del all  

vpn tu del ip-addr 

vpn tu del ip-addr username

I was thinking since smart monitor can do this from the manager why not also being able to do so from the mgmt API?

We have a lot if ipsec vpn which on Remote site have a lte router in front of a Cisco router. This LTE router being reset daily at midnight but due to missing dead Peer detection old sessions not being reset after reboot of the LTE router.

This cause sometimes we manually need to reset vpn tunnels.

This we would like to deligate to users who are not firewall experts, and do not want to allow them smart monitor or expert access.

Therefore we would like to build a portal where they can login and check connection status’s and reset vpn id wanted.

Would that we easy to implement and easy to solve?

Thanks

Best regards

Kim

[Robert_Decker]

Tomer Sole‌, we should add this to API future developments list, per product owner.

Robert.

[PhoneBoy]

This might be useful for the gateway API currently under development (i.e. where you will be able to query the gateway directly with REST API).

Alexander Kim‌

[Alexander_Kim]

Sounds nice. I will talk with VPN guys, offer them the i/s.

There could be more useful commands, the whole "vpn" binary.

Thanks

[Tomer_Sole]

you can do that today using run-script API.

Check Point - Management API reference 

[Kim_Moberg]

Thanks Tom

But then I will need to use those scripts to parse via mgmt smartconsole.

If I would my own website for internal use I will have to:

• Create a ssh to active cluster node
• Login as expert 
• Run-script with vpn tu del <peer address>
• Sign out expert mode
• Clos ssh session

This have to be done either vi asp .net or php and before that I would need to find the peer that might have an issue.

What I was thinking talking from smart monitor.

You got some kind of ping running showing the connection is open.

And you have the name of the vpn community as well as the peer address

If it was a API entry in Json I would being able to request these informations in a couple of requests.

[Tomer_Sole]

That's true. With R80.10 Management API you can only send all VPN calls to one place (the Management) rather than login to every gateway.

[Kim_Moberg]

It is fantastic to see Gaia API is now in GA.

I have already checked it out and I see a great potential of providing API to Secure gateways.

What I have looking for a long time is to include VPN shell functionality into the Gaia API.

Did not see the features available yet but have been in dialog with Alexander Kim if it could be included in a feature roadmap release and that was possible.

This is my idea basically.

To include the CLISH VPN shell and tu commands into the API. I have been freely translating how a possible API for this method fundation could look like.

https://{{ip}}/gaia_api/vpn/show-tunnels-ike  (features show all peers, or peers ip)

https://{{ip}}/gaia_api/vpn/show-tunnels-IPsec  (features show all peers, or peers ip)

https://{{ip}}/gaia_api/vpn/delete-ipsec-tunnel-all

https://{{ip}}/gaia_api/vpn/delete-ipsec-tunnel-peer

https://{{ip}}/gaia_api/vpn/delete-ipsec-peer-username

https://{{ip}}/gaia_api/vpn/delete-all-tunnels

https://{{ip}}/gaia_api/vpn/delete-peer-username

Any order ideas?

Thanks

Kim

[Claudio_Bolcato]

Hi everyone, is there any update on this topic? My operation team would need a solution like that. I'm not happy to give them write access just for resetting tunnels.

Thanks in advance