Questions around API and Monitoring

[Nüüül]

Hi there,

I might have miss it, but are there plans to extend the API possibilities regarding monitoring the Checkpoint Solution (maybe including Gateways?)?

i.e.:

• Gateway Cluster state (best, of all cluster members)
• Active Connections
• Interface status
• S2S VPN status
• Mobile Access Connections/User
• Last Policy install date/result (Warning/Errors)
• general System stats (Load, Disk etc.)
• License status
• (Dynamic Routing?)
• (Critical Errors)

and so on...

Perhaps, it is possible to fetch the informations through the Management Server API. So Management Server is acting as kind of a proxy. Or directly addressing the Gateways...through an API?

I have some customers who are using several Monitoring Solutions and want to include the central Firewall/Routing there. And sometimes SNMP is not the preferred way (When managing several gateways all over the world, for example) and some information (from above) you don´t get via SNMP.

(I hope, this is correctly located here )

Regards,

Daniel

[PhoneBoy]

Right now, we have APIs for:

• Managing access and threat prevention rulebase
• Managing identities in Identity Awareness
• Sandblast API (for Threat Emulation)

Monitoring gateways isn't part of this currently.

That said, you can use "run-script" as part of the management APIs to run any sort of CLI command against a gateway.

There are CLI commands for most of the above.

See, e.g. how to use the web api to run the run-script 

We are planning a gateway API and may add some of the above as part of this.

[Nüüül]

That was quick, thanks for the fast reply!

I already looked on the "run-script" option. As Response you only get a task-id and with "show task" I only saw that this has been run successful. Good would be, to get back the output from this script, then, for example one could execute "cphaprob state" and try to parse it into monitoring state.

Or is there a way to get the scripts result?

Thanks again

Daniel

[PhoneBoy · Accepted solution]

When I ran run-script (e.g. for cplic print) I got results right away.

If you don't, you can use show-task with the returned task-id to get this information.

Either way, the full output of the command is encoded in base64 in the responseDetails.

See: https://community.checkpoint.com/message/5757-run-script-output 

[Pedro_Espindola]

Hello Daniel,

Why is SNMP not the preferred method? It is usually the easiest, less invasive and most light weight.

You can get all these with SNMP:

• Gateway Cluster state (best, of all cluster members)
• Active Connections
• Interface status
• S2S VPN status
• Mobile Access Connections/User
• Last Policy install date and name (but not Warning and Errors)
• general System stats (Load, Disk etc.)

That said, I agree with you that for the rest it would be great to use API.

I need to be able to monitor licenses with only READ permissions.

[PhoneBoy]

You realize you could (probably) do this with SNMP using a custom MIB, right?

[Pedro_Espindola]

Yes, you are right.

I just remembered my issue was with SMB appliances, and they don't support custom oids (this sk). But then API wouldn't help anyway in locally managed cases.

[Nüüül]

Hi,

yes, i am aware of SNMP and so. just thought, that using the API one might be able to gather some more /more specific data. And as there is an API, why not using it?

And some informations are not available via SNMP, so i thought, that would be a good way..

imho - if it would be possible to gather those informations when polling the central management servers, that might be a great point for some customers with firewalls all around the world, as you don´t have to configure monitoring for all gateways in that detail.

Daniel