Scheduled policy install

[the_rock]

Hey guys,

I know this was asked before and I do know you can try do this with time objects for specific rules and also install policy on successful ips update, BUT, I cant find anywhere an option to schedule policy push on specific date time like below in forti manager for Fortigate firewalls?

Thoughts?

Andy

[Tal_Paz-Fridman · Accepted solution]

Hi Andy

This is possible in Multi-Domain Security Management using Policy Presets:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Multi-DomainSecurityManagement_Adm...

[the_rock]

Thanks Tal. We dont have any customers using MDS, so any way to do this on regular mgmt?

Andy

[Bob_Zimmerman]

One hazard with policy presets: they stick around after they've fired, and they reference objects. I was recently involved in upgrading an MDS which had hundreds of these left over referencing firewalls which had been decommissioned years earlier. The references to objects which no longer exist tanked the upgrade, and there doesn't appear to be API support for managing policy presets, so we had to manually delete them.

I wrote a script for recurring policy installations several years ago. I'll clean it up a little and share in a bit. In the main environment I currently manage, we install almost every policy every day Monday through Friday. We find it helps us identify problems more quickly, since we have fewer changes to review since the last push.

[the_rock]

Thats super VALID point @Bob_Zimmerman 

[Bob_Zimmerman]

I've just added two scripts to one of my Github repos:

https://github.com/Bob-Zimmerman/CPFirewallScripts

Check out autoPushWorker.sh and autoPush_Dev-QA.sh (which I call a "window script"). A cron job starts the window script, the window script sets up the data and passes it to the worker script. The worker script then sends a notification it's starting, pushes the policy, and sends an email with the results when it's done.

[the_rock]

Thanks Bob! I will test it.

Andy

[D_W]

Create a cron job on the management server and via mgmt api install the policy.

why do you need this?

[the_rock]

If you could give me an example, would be great! Customer asked me about it recently, possibly they may want to have it installed at night after so many changes.

Andy

[Tal_Paz-Fridman]

You can also create a SmartTask in SmartConsole that will run a predefined script after a predefined trigger like Publish.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Cont...

[the_rock]

Thanks Tal. I actually saw that the other day, but does not sadly have an option for policy install : - (

Andy

[Lesley · Accepted solution]

Here is the API part:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/install-policy~v2%20

mgmt_cli install-policy policy-package "standard" access true threat-prevention true targets.1 "corporate-gateway"  --format json
 • "--format json" is optional. By default the output is presented in plain text.

I would not recommend to auto policy push at one point it will give issues. 

The cronjob with inside the API and custom script: 

mgmt_cli install-policy --batch /home/admin/gateways.csv --format json -u username -p PW

[the_rock]

Hey Lesley,

Right, I know that part, but still does not show or gives an example of how you would run if on a specific schedule.

Andy

[Lesley]

cronjob will do that for you. if you want it to run more then once a day there is a SK how to change a cronjob to run it more often

[the_rock]

So you mean something like this under job scheduler in gaia? and then set job to run every so often?

mgmt_cli install-policy policy-package "standard" access true threat-prevention true targets.1 "corporate-gateway" 

[Bob_Zimmerman]

You would need a wrapper script to set up the environment variables (. /etc/profile.d/CP.sh) so mgmt_cli can work, and that exact command wouldn't work (for a cronjob, you need to use the full path, plus you need to pass static credentials to mgmt_cli or use '-r true').

Adding a separate cronjob per firewall you want to push to gets ugly fast.

And there's no way to suspend it temporarily. You would have to delete the cronjob, then add it back when you want to resume.

[Lesley]

correct use gaia cron job to run the script you want.

[the_rock]

Thanks!

[the_rock · Accepted solution]

Thanks everyone for your responses, always greatly appreciated.

@D_W @Bob_Zimmerman @Tal_Paz-Fridman @Tal_Paz-Fridman 

I was more thinking there was a way to enable option to check like one I uploaded from Forti manager to schedule policy install, but guess thats not possible as of yet via smart console. Anyway, not a huge deal, I ended up submitting an RFE for it.

Thanks again everyone.

Andy