Moving hosts between groups

[jfmoral]

Hi.

Do you know if there is any way to quickly move 1600 hosts from Group A to Group B?

Regards.

Management Quantum Force (Security Gateways) 

[the_rock]

Let me do quick test in the lab for this with few hosts and see what happens.

Andy

[the_rock]

Ok, forgive me if this shall sound really stupid or silly, but one easy way would be to right click existing group, clone it, which will create exact same group with name _clone on top of it, then you can delete "old" group.

If that poses an issue, Im sure it can be done via API, so let me know and I can try it in the lab.

Andy

[jfmoral]

Hi, 

Maybe I explained it in the wrong form. Group A and Group B have many Objects and I want to merge them into a single group. But I don't want to select one by one.

I'm going to look at the API.

Thanks.

[the_rock]

Kk, now I got it, no worries. Let me do some testing and see how far I get. Will update you.

Andy

[the_rock]

I recall cp_merge back in the day, but that tool was deprecated while back. I will still keep trying to make this work in the lab. In the meantime, lets see if anyone else may know.

[jfmoral]

Thank you. I am conducting tests as well.

[Amir_Senn]

You can use MGMT API for this:

Show group: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-group~v2%20

Grep names / uids.

Set group: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/set-group~v2%20

[the_rock]

Looks promising, may test this in the lab later. Does it work say if you want to move lets say only 20 out of 100 hosts to another group?

Andy

[Amir_Senn]

I would grep uid results from group into a file and if you want to want to limit number of items per publish you can do it by running a loop that runs on X objects until EOF.

mgmt_cli show group name "test" | grep "\- uid:" > uid_list.txt

[the_rock]

Man, I wish this was possible via smart console, would have been easier, but guess not?

Andy

[Amir_Senn]

You can clone or add group into another group, it would also help.

It just doesn't give you this as a list that you can use for other purposes.

[the_rock]

I know you can clone the group, but dont believe you can add one into another, but will test again.

Andy

[the_rock]

Apologies, I was wrong, my bad. Just created brand new group and it let me add 2 new groups into it. I think I was not filtering for the right objects.

Thanks @Amir_Senn 

Andy

[Bob_Zimmerman]

So you want all members of group B to be added to group A, and you want all places where group B is used to use group A instead?

Dump group B with '/show-object'. The output will have all members of the group.

Get the first ~100 members and call '/set-group' for group A with members.add[] in the body and the selected members. Adding a member which is already in the group does nothing, so this will add all the members of B which aren't already in A to A.

Repeat for the next ~100 members until you're done.

In SmartConsole, run a Where Used on group B, hit the Replace button in the window, pick group A, and select the places where you want to replace it. If there's anywhere which can't be automatically replaced, you'll have to handle it manually.

[the_rock]

Sounds reasonable, will try this as well.