I would like to share with you a tool for automatic configuration of Check Point management server and Check Point gateways. The tool is based on CP Management API, CP GAiA API, Ansible and enables a range of gateways and management related configuration actions. The tool is easily extendable.
The tool can be considered as a good starting point for the automation of your Check Point environment.
For management server
Following configuration is possible on management server:
- Create/delete network, ranges, services objects
- Create/delete policy packages
- Add rules to the policy packages
- Add gateways, establish SIC
- Install policy on the gateways
Following configuration is possible on gateways in accordance to various gateways attributes like CMA, SW version, gateway type, platform type, gateway IP.
- DNS configuration
- Users configuraion
- Expert password configuration
- User public keys copy
Which means you can configure DNS, Users, Expert password or Users public keys specifically for gateways in certain CMAs or for gateways having certain SW version, or platform type, or IP address.
Below are the tool structure and the steps for the gateways configuration part.
- Ansible playbook starts Dynamic Inventory Script
- Dynamic Inventory Script gets the list of all gateways from SMS or MDS via MGMT API.
- Dynamic Inventory Script reads the services configuration files.
- Dynamic Inventory Script creates the Ansible inventory files based on gateways list and services configuration.
- Ansible configures the gateways via GAiA API (and via SSH for expert mode) according to inventory files.
License, warranty, contact
The tool is provided with APACHE2.0 and without any liability, warranty or support. In case, you are interested in support or customization please contact Check Point Profession Services under:
Detailed tool information is provided in the attached documentations and videos.
I hope the tool will be beneficial for you and I would appreciate your feedback. 🙂