Ansible module collection for Check Point host facts and Deployment Agent

[Duane_Toler]

This is an Ansible module collection for additional tasks on Check Point hosts:

https://github.com/Webfargo/ansible-collection-check_point/

webfargo.check_point.da_command:                  Run arbitrary da_cli commands 
webfargo.check_point.da_package:                  Manage Check Point packages via the Deployment Agent 
webfargo.check_point.da_package_info:             Query Check Point Deployment Agent package information 
webfargo.check_point.da_status:                   Get Check Point Deployment Agent status 
webfargo.check_point.gather_facts:                Gather Check Point Gaia OS specific facts
webfargo.check_point.cp_gateway_vpn_certificate:  Renew IPsec VPN certificate on gateway or cluster
webfargo.check_point.cp_ia_identity_info:         Query Check Point Identity Awareness associations for one IP via the Identity Web API
webfargo.check_point.cp_ia_identity:              Add or delete Check Point Identity Awareness associations via the Identity Web API

Install from Ansible Galaxy:

ansible-galaxy collection install webfargo.check_point

Direct install from GitHub with ansible-galaxy:

ansible-galaxy collection install git+https://github.com/Webfargo/ansible-collection-check_point.git

The gather_facts module includes these Check Point host facts:

• Check Point version (R81.20, R82, R82.10, etc.)
• Installed hotfix versions (for all installed products)
• Live Patch modules and status for each
• Host type (gateway/management/standalone)
• OS code name and build number
• Deployment Agent build number
• SIC certificate info
• Hardware platform
• VSX status
• Cluster/HA status
• Check Point SNMP daemon status
• Firewall policy status (if gateway)

The Deployment Agent modules include:

• Verify, Install, Uninstall packages
• Blink and clean-install/upgrade packages
• Import packages from local disk
• Update package repository
• Query package repository
• Check Deployment Agent status
• Run arbitrary Deployment Agent commands

Package install/uninstall operations will poll the Deployment Agent task continuously to monitor the progress. When the host reboots, the status is monitored to return a successful status rather than dropping the connection. The Ansible module wait_for_connection can be used to monitor the host's reboot operation.

For Blink package upgrades, the multi-stage reboot is monitored by the da_package module to check the stage 2 operation rather than dropping the SSH connection.

Packages can be copied with the Ansible module ansible.builtin.copy and imported to the package repository.

Although R82 has introduced package management with the management API,  there may be times when direct package management may be necessary on the remote host.  For those without R82 yet, this could help you get there! 

[Duane_Toler]

v0.7.0 has been release, fixing some bugs, install and upgrade state oddities encountered recently:

https://github.com/Webfargo/ansible-collection-check_point/tree/v0.7.0

Change Log included, too: https://github.com/Webfargo/ansible-collection-check_point/blob/v0.7.0/CHANGELOG.md

[Duane_Toler]

Version 0.9.4 of my module collection for Check Point hosts has been published to Ansible Galaxy:

https://galaxy.ansible.com/ui/repo/published/webfargo/check_point/

The gather_facts module now includes Live Patch facts.

  tasks:
    - name: Gather Check Point facts
      webfargo.check_point.gather_facts:

    - name: Check if a specific CVE is covered by a live patch
      debug:
        msg: "CVE-2026-85102 is live patched"
      when: >-
        ansible_facts.check_point.live_patches |
        selectattr('comment', 'search', 'CVE-2026-85102') |
        map(attribute='modules') | flatten |
        selectattr('cover', 'equalto', 'ok') | list | length > 0

Install or update with:

ansible-galaxy collection install webfargo.check_point

Additional modules include:

• cp_gateway_vpn_certificate: Renew VPN certificates on Check Point gateway or cluster objects
  
  

  - name: Renew VPN certificate on a simple gateway
    webfargo.check_point.cp_gateway_vpn_certificate:
      name: gw-prod-01
      gateway_type: gateway
      certificate_name: defaultCert
      alternate_names:
        - name_type: fqdn
          value: gw-prod-01.example.com
        - name_type: ip address
          value: 192.0.2.10
  
  - name: Renew VPN certificate on a cluster object
    webfargo.check_point.cp_gateway_vpn_certificate:
      name: cluster-prod-01
      gateway_type: cluster
      certificate_name: defaultCert
      alternate_names:
        - name_type: fqdn
          value: cluster-prod-01.example.com
  
  - name: Renew without auto-publishing (caller publishes later)
    webfargo.check_point.cp_gateway_vpn_certificate:
      name: gw-prod-02
      gateway_type: gateway
      certificate_name: defaultCert
      auto_publish_session: false
      alternate_names:
        - name_type: ip address
          value: 192.0.2.20
  

• cp_ia_identity_info: Query Check Point Identity Awareness associations for one IP via the Identity Web API

• cp_ia_identity: Add or delete Check Point Identity Awareness associations via the Identity Web API
  

  - name: Add an identity association
    webfargo.check_point.cp_ia_identity:
      ia_host: "{{ ia_mgmt_host }}"
      shared_secret: "{{ identity_api_secret }}"
      ip_address: "10.10.5.23"
      user: "jdoe"
      domain: "corp.example.com"
      user_groups:
        - "vpn-users"
      fetch_user_groups: false
      calculate_roles: true
      identity_source: "{{ inventory_hostname }}"
  
  - name: Look up current identity associations for an IP
    webfargo.check_point.cp_ia_identity_info:
      ia_host: "{{ ia_mgmt_host }}"
      shared_secret: "{{ identity_api_secret }}"
      ip_address: "10.10.5.23"
    register: id_result
  
  - name: Show whether any records were found
    ansible.builtin.debug:
      msg: "{{ id_result.identity_info.found }} ({{ id_result.identity_info.record_count }} records)"