Ansible architectur info

[Mando_92]

Hello everybody,

I need some answers /clarifications as to how possible works with Check Point, obviously it is based on the functioning of the API and about this there is a web page "Management API Reference"

• Ansible modules are divided into two large families that can be consulted on the respective ansible galaxy web pages, Check Point Ansible Mgmt Collection (mgmt plugin) with which I can automate only some operations, the same thing
  Check Point Ansible Gaia collection (gaia plugin).

  These two starting modules have in turn a series of playbooks for the operations / automations that are now possible and supported.
  Did I get it right ?

• The various playbooks of Ansible that I am going to use can I launch from the various interfaces provided for the API or some are not supported ?
  mgmt_cli tool
  Web Services
  SmartConsole CLI
  Gaia CLI

I thank in advance all those who will answer me and clarify any doubts

[PhoneBoy]

There are Ansible modules that correspond to the Management API and Gaia API, yes.
Due to the way Ansible works, only a subset of operations available from the APIs are available in Ansible.
mgmt_cli, Web Services, SmartConsole CLI, and Gaia CLI are ways to leverage the API and are not relevant to Ansible.

[Mando_92]

Thanks for response !

Only one thing is not clear to me, what you mean by:

"Due to the way Ansible works, only a subset of operations available from the APIs are available in Ansible."

If I understand correctly I can only use one of the two ways or Ansible for mgmt or ansible for Gaia (I enclose screenshot)

Thanks

[PhoneBoy · Accepted solution]

The Management API and Gaia API are used for different tasks.
Depending on what you are trying to do, you may use one or both.

Ansible only allows you to describe the desired end state of the configuration of the overall system.
Ansible then calls the native Check Point APIs in the appropriate order to achieve the desired configuration.

The native API calls allow you to prescribe the exact steps needed to achieve a desired configuration.
However, you must know the precise order to call the APIs to achieve the desired configuration.
The APIs do allow for things that cannot be described in the Ansible framework.

I hope that makes sense. 

[Mando_92]

I thank you for your availability and for having clarified my doubts!
Unfortunately I am not a Network DevOps and having no experience in this regard I am trying to learn.

I ask you one last thing seeing the Ansible playbooks available to date for Check Points on the respective links (mgmt and gaia) at first glance it does NOT seem possible to completely automate with Ansible the initial configuration of a physical infrastructure composed of GW clusters and SMART clusters- 1 however, it seems to me that automation on operation-oriented tasks can be implemented very well.

Best Regards

[PhoneBoy]

Right, the APIs in question (and thus the Ansible modules and playbooks) focus on the day-to-day operations, not the initial installation/configuration.
For virtual gateway instances, we can do some automated deployment of gateways using the various mechanisms provided by the cloud.
For physical gateways, there are ways to automate the deployment (blink images, CDT, etc) but not via Ansible.
The initial deployment of management can be partially automated like gateways, but the need to deploy management in an automated fashion is typically far less.