cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

 

Hi @G_W_Albrecht 

Unfortunately I don't have a TX applinace in the LAB to test it. Could you send me the first lines from objects.C to TX appliance?  I search via grep for :gateway. Maybe it's a little different with the TX appliance.

Tags (1)

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution
: (TXer
:type (host)
:custom_fields (
: (
:custom_field_id (ReferenceObject
:Uid ("{739B70D5-7B76-48D2-96CC-FB647074F524}")
:Name ("Contact Details")
:Table (NO_CPMI_TABLE)
)
)
: (
:custom_field_id (ReferenceObject
:Uid ("{E07938DB-1EB1-461A-A78D-36EE34A8CC5D}")
:Name (Name)
:Table (NO_CPMI_TABLE)
)
)
)
:fw_clamp_tcp_mss_control (false)
:UA_WebAccess (false)
:cpver (9.0)
:appfw_limit_chunk_size_factor (2)
:av_integrated (false)
:Everest (false)
:enable_identity_logging (false)
:clp_override_global_config (false)
:appfw_limit_low_threshold_factor (80)
:traditional_av_deactivation_time (never)
:log_indexer (false)
:enable_auto_contracts_update (false)
:user_dir_blade (false)
:eps_remoteHelp (false)
:asm_synatk_timeout (5)
:use_loggers_and_masters (true)
:smartevent_intro (false)
:gtp_fg_context_timeout (300)
:allow_send_logs (false)
:capsule_docs_consumer (false)
:gtp_rate_limit (2048)
:addr_type_indication (IPv4)
:gtp_tunnels_hashsize (65536)
:sam_policy_max_reqs (20000)
:device_settings_module (not-installed)
:Enable_CPSyslogD (false)
:MetaIP_UAT (false)
:uf_integrated (false)
:cp_suite_type (pro)
:supports_tcp_ike (use_site_default)
:management (false)
:WAM (false)
:capsule_docs_blade (not-installed)
:integrity_server (false)
:primary_stand_alone_web_ui_port (443)
:asm_synatk_active_mode (1)
:support_ip_pool_nat (false)
:ike_support_crash_recovery_sr (true)
:exportable (false)
:active_conn_view (false)
:MetaIP_DNS_Server (false)
:sam_allow_remote_request (false)
:connectra (false)
:enable_rtm_traffic_report_per_connection (false)
:capsule_docs_web_viewer (false)
:ips_event_correlator (false)
:fwfrag_timeout_log_interval (60)
:ca_wait_mode (false)
:ssl_inspection_enabled (false)
:gtp_pending_hashsize (65536)
:threat_emulation_blade (installed)
:sc_portal (false)
:abacus_server (false)
:integrity_server_port (443)
:data_awareness_blade (not-installed)
:SD_profile (ReferenceObject
:Name (TE100X_6c401f8c5eb9aa9a)
:Table (profiles)
:Uid ("{0196C658-3664-764D-B357-A55204EDF502}")
)
:threat_engine_mode (by_policy)
:MetaIP_DHCP_Server (false)
:gtp_paths_timeout (600)
:used_globaly (false)
:connection_state (communicating)
:primary_management (false)
:appfw_referrer_inspect_on (true)
:high_memory_watermark (90)
:default_track (alert)
:appfw_web_browsing_logging (global)
:antispam_integrated (false)
:svn_build_num (992000000)
:ips_update_policy (unknown)
:management_type (3_Blades_Basic)
:gtp_sam_close_upon_delete (false)
:send_to_checkpoint (true)
:low_memory_watermark (70)
:ipaddr (172.27.39.191)
:enforce_gtp_rate_limit (false)
:sam_enable_purge_history_file (false)
:is_bypass_sd_under_load (false)
:mta_enabled (false)
:cdm_module (not-installed)
:enable_application_control_usercheck_agent (false)
:gtp_ldap_cache_timeout (90)
:radius_server (ReferenceObject

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Hi @G_W_Albrecht ,

Thanks for objects.C output.

I thought so! The TX Appliances has the type ":type (host)" and not ":type (gateway)"

Tags (1)

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

I search with grep for the following:

grep -A 500 -B 1  ':type (gateway)'

 

I'll have to take a closer look in the next few days.

Regards

Heiko

 

Tags (1)

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Hello  @HeikoAnkenbrand 

I can confirm that the TE appliance is not recognized.

 

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Hi @G_W_Albrecht 

I had found an other way to parse gateways on R80:

 

mgmt_cli -r true show gateways-and-servers details-level full --format json | $CPDIR/jq/jq -r '.objects[] | select(.type | contains("Member","simple-gateway")) | ."ipv4-address"'

 

 

I will add this after Easter holidays.

Tags (1)

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

If necessary I have to adjust the filter a little bit.

Tags (1)

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

 

Hello @HeikoAnkenbrand 

This solution only works on R80 and above, doesn't it?

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Yes, this works very good ! Also gets the TE  appliance...

Kai_O_
Iron

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Great new commands😁

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Is the command name g_mclish or gw_mclish?

 

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

gw_mclish is the correct command.

Tags (1)

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

The new commands are very great.

Thanks
Caytana

 

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Hello @HeikoAnkenbrand,

The command gw_detect80 works very fast and well. TE applicances are not recognized.

Regards

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

The new version 0.4 with the command gw_detect80 is available.

Tags (1)

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

SMB Appliances are not recognized. Can you please change that?

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Hi @HeikoAnkenbrand 

We have over 100 gateways in use worldwide. That makes life easier for me with many things. I can finally execute commands centrally on the gateways.

It's a great idea.

Thank you

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Is this a R80.30 command?

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Can I use this tool under R80.30?

0 Kudos
Employee
Employee

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Interesting script, I would suggest that the resulting scripts made be put into "/usr/bin" instead of "/usr/local/bin", I checked the PATH variable and found that "/usr/local/bin" is not included for some users.

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Thanks @Frank_Allen 

I check this in the next few days.

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Very nice command extension.

 

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Great tool.

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Great job!

Is it in roadmap to add support for MDS as well? 🙂 

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Here is a quick and dirty mod for MDS R77.30 

 

#!/bin/bash

#  mds_gw_detect (R77)

 

# export all Check Point environment variables
. /opt/CPshared/5.0/tmp/.CPprofile.sh

# go to MDS context
mdsenv
mcd

if [[ -f /var/log/g_mds_gws.txt ]]; then
rm /var/log/g_mds_gws.txt
fi
# iterate over the customers
for CMA_NAME in `$MDSVERUTIL AllCMAs`
do
mdsenv $CMA_NAME
echo Searching thru $CMA_NAME
$MDSDIR/bin/cpmiquerybin attr "" network_objects "class='gateway_ckp'|class='cluster_member'|class='vsx_netobj'|class='vsx_cluster_member'" -a ipaddr |awk -v svar="$CMA_NAME" '{ print svar ";" $1 }' >> /var/log/g_mds_gws.txt
done
echo " Start less. enter to proceed. Hit q to quit from less"
read ans
less /var/log/g_mds_gws.txt
exit

 

mbash for MDS

#!/bin/bash
# export all Check Point environment variables
#. /opt/CPshared/5.0/tmp/.CPprofile.sh
. $CPDIR/tmp/.CPprofile.sh

if [ ! -f /var/log/g_mds_gws.txt ]; then
echo "First start \"mds_gw_detect\" and\or edit the file /var/log/g_mds_gws.txt manually. Add here all your CMAs and gateway IP addresses."
else
HAtest="$@"
echo $HAtest > /var/log/g_command.txt;
OIFS=$IFS
IFS=";"
while read FILE
do
line=($FILE)
CMA=${line[0]}
GW=${line[1]}
echo CMA=$CMA GW=$GW
mdsenv $CMA
if $CPDIR/bin/cprid_util getarch -server $GW |grep "gaia" > /dev/null;
then
echo "--------- GAIA $GW execute command: $HAtest"
$CPDIR/bin/cprid_util -server $GW putfile -local_file /var/log/g_command.txt -remote_file /var/log/g_command.txt;
$CPDIR/bin/cprid_util -server $GW -verbose rexec -rcmd /bin/bash -f /var/log/g_command.txt
else
echo "--------- STOP $line Error: no SIC to gateway $GW or no compatible gateway or Rulebase drops FW_CPRID "
fi
done < /var/log/g_mds_gws.txt
IFS=$OIFS

fi

 

 

Give it a go.. 

Cheers 

Declan

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Slightly modified and now works for me, just one CMA, where only one VS is connected is failing with the below error. Will need to look at it closer.

cma-XXX-p
cma-XXX-p Error: 'Failed
cma-XXX-p
cma-XXX-p Error: 'Session
cma-XXX-p
cma-XXX-p Usage:
cma-XXX-p cpmiquerybin <query
cma-XXX-p
cma-XXX-p Examples:
cma-XXX-p - print
cma-XXX-p cpmiquerybin object
cma-XXX-p - print
cma-XXX-p cpmiquerybin attr
cma-XXX-p

 

-----detect-----

#!/bin/bash
#export all Check Point environment variables
. /opt/CPshared/5.0/tmp/.CPprofile.sh

#go to MDS context
mdsenv
mcd

if [ -f /var/log/mds_gws ]; then rm /var/log/mds_gws; fi

for CMA_NAME in $($MDSVERUTIL AllCMAs);
do
mdsenv $CMA_NAME
echo "Searching through CMA $CMA_NAME" 
$MDSDIR/bin/cpmiquerybin attr "" network_objects " (type='cluster_member' & vsx_cluster_member='true' & vs_cluster_member='true') | (type='cluster_member' & (! vs_cluster_member='true')) | (vsx_netobj='true') | (type='gateway'&cp_products_installed='true' & (! vs_netobj='true') & connection_state='communicating')" -a __name__,ipaddr | awk -v svar="$CMA_NAME" '{print svar " " $1 " " $2}' >> /var/log/mds_gws
done
echo "Output is available in /var/log/mds_gws"
exit

 

-----gw_mbash for MDS-----
#!/bin/bash
#export all Check Point environment variables
#./opt/CPshared/5.0/tmp/.CPprofile.sh
.$CPDIR/tmp/.CPprofile.sh

if [ ! -f /var/log/mds_gws ]; then
echo "First start \"mds_gw_detect\" and\or edit the file /var/log/mds_gws manually. Add here all your CMAs and gateway IP addresses."
else
HAtest="$@"
echo $HAtest > /var/log/g_command.txt;

while read line
do

CMA=`echo "$line" | awk '{print $1}'`
GW_name=`echo "$line" | awk '{print $2}'`
GW_IP=`echo "$line" | awk '{print $3}'`

echo $CMA $GW_name ($GW_IP)
mdsenv $CMA

if $CPDIR/bin/cprid_util getarch -server $GW_IP |grep "gaia" > /dev/null;
then
echo "--------- GAIA $GW_IP execute command: $HAtest"
$CPDIR/bin/cprid_util -server $GW_IP putfile -local_file /var/log/g_command.txt -remote_file /var/log/g_command.txt;
$CPDIR/bin/cprid_util -server $GW_IP -verbose rexec -rcmd /bin/bash -f /var/log/g_command.txt
else
echo "--------- STOP $line Error: no SIC to gateway $GW or no compatible gateway or Rulebase drops FW_CPRID "
fi
done < /var/log/mds_gws
fi
chmod +x /usr/local/bin/gw_mbash

 

0 Kudos

Re: GAIA - Easy execute CLI commands on all gateways simultaneously

Jump to solution

Top idea!

0 Kudos