Re: cpmiquerybin for VPN monitoring

Michael_Rolbin · ‎2018-08-30

How can I get by #cpmiquerybin a list of VPN Gateways in VPN community?

Maybe you have examples how to monitor VPN resources and tunnels by cpmiquerybin?

PhoneBoy · ‎2018-08-31

Pretty sure cpmiquerybin is not the correct way to discover this information.

From the R80.x API, you should be able to print the relevant VPN community to determine what gateways are in a given community, using show vpn-community-meshed name CommunityName.

From there, you can connect to the relevant gateways and monitor tunnels using vpn tu or the relevant tables.

Michael_Rolbin · ‎2018-08-31

The problem is that API is not enabled by default on CP R80.x products. How can we retrieve the information about VPN community gateways out of API?

PhoneBoy · ‎2018-08-31

The API is definitely enabled by default, but it isn't accessible from anything but localhost unless you configure it.

If it weren't enabled, you would not be able to use the mgmt_cli command.

SmartConsole might not work so well without it, either

The first command shows you the "meshed" VPN communities.

The second command shows you how you would actually see what gateways are in the community (though in this case, there are no configured).

There are similar API commands for "star" communities (show vpn-communities-star and show vpn-community-star).

[Expert@MGMT:0]# mgmt_cli -r true show vpn-communities-meshed

objects:

- uid: "6b8e4ed1-ccd4-43e2-ba94-1ee35d652cf7"

type: "vpn-community-meshed"

domain:

uid: "41e821a0-3720-11e3-aa6e-0800200c9fde"

domain-type: "domain"

from: 1

to: 1

total: 1

[Expert@MGMT:0]# mgmt_cli -r true show vpn-community-meshed name MyIntranet

uid: "6b8e4ed1-ccd4-43e2-ba94-1ee35d652cf7"

type: "vpn-community-meshed"

domain:

uid: "41e821a0-3720-11e3-aa6e-0800200c9fde"

domain-type: "domain"

gateways: []

use-shared-secret: false

encryption-method: "ikev1 for ipv4 and ikev2 for ipv6 only"

encryption-suite: "custom"

ike-phase-1:

encryption-algorithm: "aes-256"

diffie-hellman-group: "group-2"

data-integrity: "sha1"

ike-phase-2:

encryption-algorithm: "aes-128"

data-integrity: "sha1"

comments: ""

color: "black"

icon: "VPNCommunities/Meshed"

tags: []

meta-info:

lock: "unlocked"

validation-state: "ok"

last-modify-time:

posix: 1495347014592

iso-8601: "2017-05-20T23:10-0700"

last-modifier: "System"

creation-time:

posix: 1495347014592

iso-8601: "2017-05-20T23:10-0700"

creator: "System"

read-only: false

Michael_Rolbin · ‎2018-08-31

Thank you for the API reference!

I know that CP pushing to use API, and it's right way to work. Unfortunately, API has limitations as you mentioned, and 4 GB RAM to be able to run API.

My question still there, in case a customer didn't enable remote API access, can we get the VPN community GWs (not just information about VPN community IKE phases, but Firewalls names and IPs) information by the query?

PhoneBoy · ‎2018-08-31

The fact you're mentioning anything less than 6GB of RAM (required to run R80.x) suggests you're on an earlier release, is that correct?

That would have been a very relevant detail to mention up-front and would have saved a few messages

Michael_Rolbin · ‎2018-08-31

🙂 I'm on R80.10 T421

PhoneBoy · ‎2018-08-31

In any case, the documentation for cpmiquerybin is: How to use the 'cpmiquerybin' command to list objects and their attributes

From reading this, there doesn't appear to be a way to dump the VPN communities, only regular network objects.

But, you should be able to use dbedit to do it, provided you know the community name(s) in question.

[Expert@MGMT:0]# dbedit -local

Please enter a command, -h for help or -q to quit:

dbedit> print communities MyIntranet

Object Name: MyIntranet

Object UID: {6B8E4ED1-CCD4-43E2-BA94-1EE35D652CF7}

Class Name: intranet_community

Table Name: communities

Last Modified by: System

Last Modified from: localhost

Last Modification time: Sat May 20 23:10:14 2017

Fields Details

--------------

ID: 1

add_routed_domain: NULL

allow_all_encrypted_traffic: false

allow_all_encrypted_traffic_on: both

automatic_RIM: true

automatic_RIM_satellites: false

backup_stickiness: false

color: black

comments:

cryptography: (

cryptography_profile: custom_profile

cryptography_type_support: ike_v1_only

)

customer_script_center: false

customer_script_satellites: false

default_mep_rule: (

Priority1:

Priority2:

Priority3:

source:

)

disable_NAT: false

disable_NAT_on: both

enable_MEP: false

exclude_srv:

ext_gateways_shared_secret: (

(

<NULL>

)

ike_p1: (

ike_p1_dh_grp: Name: Group 2 (1024 bit) (Table: encryption)

ike_p1_enc_alg: AES-256

ike_p1_hash_alg: SHA1

ike_p1_rekey_time: 1440

ike_p1_use_aggressive: false

ike_p1_use_aggressive_for_DAIP: false

ike_p1_use_shared_secret: false

ike_p1_use_shared_secret_for_DAIP: false

)

ike_p2: (

ike_p2_enc_alg: AES-128

ike_p2_hash_alg: SHA1

ike_p2_ipcomp: None

ike_p2_pfs_dh_grp: Name: Group 2 (1024 bit) (Table: encryption)

ike_p2_rekey_kbytes: 50000

ike_p2_rekey_time: 3600

ike_p2_use_pfs: false

ike_p2_use_rekey_kbytes: false

ike_p2_use_subnets: true

)

manual_mep_rules: (

(

<NULL>

)

mep_mechanism: src

meshed_in_center: false

participant_gateways:

participants_domains: (

(

<NULL>

)

permanent_tunnel_down_track: log

permanent_tunnel_list: (

(

<NULL>

)

permanent_tunnel_participant_list:

permanent_tunnel_participants: all_members

permanent_tunnel_up_track: log

permanent_tunnels_def: none

route_injection_track: log

route_ret_packets: false

route_through_center: none

satellite_gateways:

sel_mechanism: first

support_wire_mode: false

support_wire_mode_routing: false

topology: meshed

tunnel_granularity: per_subnet

type: intranet_community

vpn_mep_resolver_notification: log

Michael_Rolbin · ‎2018-08-31

Awesome, thank you!

Michael_Rolbin · ‎2018-09-04

Is there any option to get the VPN Community Name from a VPN GW?

PhoneBoy · ‎2018-09-04

A gateway can actually be a member of multiple communities.

I'm not aware of a way of determining this using just the gateway name.

But, you can dump the list of VPN Communities in dbedit:

[Expert@mumford:0]# dbedit -local

Please enter a command, -h for help or -q to quit:

dbedit> printxml communities

<communities_object>MyIntranet

<ID>1</ID><allow_all_encrypted_traffic>false</allow_all_encrypted_traffic>

<allow_all_encrypted_traffic_on><![CDATA[both]]></allow_all_encrypted_traffic_on><automatic_RIM>true</automatic_RIM><automatic_RIM_satellites>false</automatic_RIM_satellites><backup_stickiness>false</backup_stickiness>

<cryptography_profile><![CDATA[custom_profile]]></cryptography_profile>

<cryptography_type_support><![CDATA[ike_v1_only]]></cryptography_type_support>

</cryptography><customer_script_center>false</customer_script_center><customer_script_satellites>false</customer_script_satellites>

<default_mep_rule>

</Priority1>

</Priority2>

</Priority3>

</source>

</default_mep_rule><disable_NAT>false</disable_NAT>

<disable_NAT_on><![CDATA[both]]></disable_NAT_on><enable_MEP>false</enable_MEP>

<exclude_srv>

</exclude_srv>

<ext_gateways_shared_secret>

</ext_gateways_shared_secret>

<ike_p1>

<ike_p1_dh_grp>ReferenceObject

<Name>Group 2 (1024 bit)</Name>

<Table>encryption</Table>

</ike_p1_dh_grp>

<ike_p1_enc_alg><![CDATA[AES-256]]></ike_p1_enc_alg>

<ike_p1_hash_alg><![CDATA[SHA1]]></ike_p1_hash_alg>

<ike_p1_rekey_time>1440</ike_p1_rekey_time><ike_p1_use_aggressive>false</ike_p1_use_aggressive><ike_p1_use_aggressive_for_DAIP>false</ike_p1_use_aggressive_for_DAIP><ike_p1_use_shared_secret>false</ike_p1_use_shared_secret><ike_p1_use_shared_secret_for_DAIP>false</ike_p1_use_shared_secret_for_DAIP>

</ike_p1>

<ike_p2>

<ike_p2_enc_alg><![CDATA[AES-128]]></ike_p2_enc_alg>

<ike_p2_hash_alg><![CDATA[SHA1]]></ike_p2_hash_alg>

<ike_p2_ipcomp><![CDATA[None]]></ike_p2_ipcomp>

<ike_p2_pfs_dh_grp>ReferenceObject

<Name>Group 2 (1024 bit)</Name>

<Table>encryption</Table>

</ike_p2_pfs_dh_grp>

<ike_p2_rekey_kbytes>50000</ike_p2_rekey_kbytes>

<ike_p2_rekey_time>3600</ike_p2_rekey_time><ike_p2_use_pfs>false</ike_p2_use_pfs><ike_p2_use_rekey_kbytes>false</ike_p2_use_rekey_kbytes><ike_p2_use_subnets>true</ike_p2_use_subnets>

</ike_p2>

<manual_mep_rules>

</manual_mep_rules>

<mep_mechanism><![CDATA[src]]></mep_mechanism><meshed_in_center>false</meshed_in_center>

<participant_gateways>

<unnamed_element setname="">ReferenceObject

<Name>dummygw</Name>

<Table>network_objects</Table>

</unnamed_element>

</participant_gateways>

<participants_domains>

</participants_domains>

<permanent_tunnel_down_track><![CDATA[log]]></permanent_tunnel_down_track>

<permanent_tunnel_list>

</permanent_tunnel_list>

<permanent_tunnel_participant_list>

</permanent_tunnel_participant_list>

<permanent_tunnel_participants><![CDATA[all_members]]></permanent_tunnel_participants>

<permanent_tunnel_up_track><![CDATA[log]]></permanent_tunnel_up_track>

<permanent_tunnels_def><![CDATA[none]]></permanent_tunnels_def>

<route_injection_track><![CDATA[log]]></route_injection_track><route_ret_packets>false</route_ret_packets>

<route_through_center><![CDATA[none]]></route_through_center>

<satellite_gateways>

</satellite_gateways>

<sel_mechanism><![CDATA[first]]></sel_mechanism><support_wire_mode>false</support_wire_mode><support_wire_mode_routing>false</support_wire_mode_routing>

<tunnel_granularity><![CDATA[per_subnet]]></tunnel_granularity>

<vpn_mep_resolver_notification><![CDATA[log]]></vpn_mep_resolver_notification>

</communities_object>

<communities_object>RemoteAccess

<ID>2</ID><automatic_RIM>true</automatic_RIM><automatic_RIM_satellites>false</automatic_RIM_satellites><backup_stickiness>false</backup_stickiness>

<cryptography_profile><![CDATA[custom_profile]]></cryptography_profile>

<cryptography_type_support><![CDATA[ike_v1_only]]></cryptography_type_support>

</cryptography><customer_script_center>false</customer_script_center><customer_script_satellites>false</customer_script_satellites>

<default_mep_rule>

</Priority1>

</Priority2>

</Priority3>

</source>

</default_mep_rule><enable_MEP>false</enable_MEP>

<ike_p1>

<ike_p1_dh_grp>ReferenceObject

<Name>Group 2 (1024 bit)</Name>

<Table>encryption</Table>

</ike_p1_dh_grp>

<ike_p1_enc_alg><![CDATA[AES-256]]></ike_p1_enc_alg>

<ike_p1_hash_alg><![CDATA[SHA1]]></ike_p1_hash_alg>

<ike_p1_rekey_time>1440</ike_p1_rekey_time><ike_p1_use_aggressive>false</ike_p1_use_aggressive><ike_p1_use_aggressive_for_DAIP>false</ike_p1_use_aggressive_for_DAIP><ike_p1_use_shared_secret>false</ike_p1_use_shared_secret><ike_p1_use_shared_secret_for_DAIP>false</ike_p1_use_shared_secret_for_DAIP>

</ike_p1>

<ike_p2>

<ike_p2_enc_alg><![CDATA[AES-128]]></ike_p2_enc_alg>

<ike_p2_hash_alg><![CDATA[SHA1]]></ike_p2_hash_alg>

<ike_p2_ipcomp><![CDATA[None]]></ike_p2_ipcomp>

<ike_p2_pfs_dh_grp>ReferenceObject

<Name>Group 2 (1024 bit)</Name>

<Table>encryption</Table>

</ike_p2_pfs_dh_grp>

<ike_p2_rekey_kbytes>50000</ike_p2_rekey_kbytes>

<ike_p2_rekey_time>3600</ike_p2_rekey_time><ike_p2_use_pfs>false</ike_p2_use_pfs><ike_p2_use_rekey_kbytes>false</ike_p2_use_rekey_kbytes><ike_p2_use_subnets>true</ike_p2_use_subnets>

</ike_p2>

<manual_mep_rules>

</manual_mep_rules>

<mep_mechanism><![CDATA[src]]></mep_mechanism>

<participant_gateways>

<unnamed_element setname="">ReferenceObject

<Name>oscar</Name>

<Table>network_objects</Table>

</unnamed_element>

<unnamed_element setname="">ReferenceObject

<Name>dummygw</Name>

<Table>network_objects</Table>

</unnamed_element>

</participant_gateways>

<participant_users_groups>

<unnamed_element setname="">ReferenceObject

<Name>All Users</Name>

<Table>globals</Table>

</unnamed_element>

</participant_users_groups>

<participants_domains>

</participants_domains>

<route_injection_track><![CDATA[log]]></route_injection_track><route_ret_packets>false</route_ret_packets>

<sel_mechanism><![CDATA[first]]></sel_mechanism>

<vpn_mep_resolver_notification><![CDATA[log]]></vpn_mep_resolver_notification>

</communities_object>

Michael_Rolbin · ‎2018-09-04

We found that VPN community information stored on the VPN GW in a file:

$FWDIR/state/local/FW1/local.intranet_community

Are you a member of CheckMates?

cpmiquerybin for VPN monitoring