The command "show ips-status" in the Management API which firewall IPS status was showed?

[Enzooo_PHN]

As we know management API have a command "show ips-status" can show the ips blades current status. but I'm confused that command only can output one result. and you can't know the result is which firewall IPS blade status, when your management server managed lots of firewall devices. I though this result shouldn't be the management server's info as we know it doesn't have IPS blades.

I'd like to know how to get all managed firewall devices IPS status through web_API. Or another way to get it which can let me automate get this info.

[emmap]

That is showing the IPS update information on the management server.

[Enzooo_PHN]

management server doesn't own IPS blade. why it shows ips status. I sensitively doubt this. if you were right, could you show me how to check managed firewall IPS blades status one by one through WEB_API?

[G_W_Albrecht]

https://sc1.checkpoint.com/documents/latest/APIs/index.html?#clish/show-ips-status~v1.6

The mgmt_cli tool is installed as part of Gaia on all R80 gateways and can be used in scripts running in expert mode.

[PhoneBoy]

It’s showing you the state of the IPS database on the management server, which can be used to update the various managed gateways.
If you want to see the state on a gateway, you need to make a call to the relevant gateway with the run-script API endpoint.

[Enzooo_PHN]

Thank you what a nutritious reply. So, could you show me which script command should I use to call it? Do you have a more detailed example?

[PhoneBoy · Accepted solution]

The command you run on the gateway to determine if IPS blade is enabled and, if so, what version of the database it has: ips stat.
The run-script API is documented here: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/run-script~v1.9%20
Which translates to something like:

mgmt_cli -r true run-script script-name "Get status of IPS on Gateway" script "ips stat" targets.1 "MyGateway"

This API endpoint is asynchronous, meaning it will return a task-id instead of the results of that script.
To see the results, you need to use the show-task API: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-task~v1.9%20
The responseMessage is encoded in base64 format, which will need to be decoded.
Thankfully, this can easily be done with the CLI:

mgmt_cli -r true --format json show-task task-id "d23f46e1-0f6a-4c53-8d94-380d292d6781" details-level full | jq '.tasks[]."task-details"[].responseMessage' | base64 -id

To explain this command (entered from expert mode on the management):

• -r true is a simple way to execute API commands from the management without providing credentials.
• --format json ensures mgmt_cli returns data in JSON format (by default it does not, but direct API calls will).
• jq '.tasks[]."task-details"[].responseMessage' (after the |) pulls out the responseMessage from the mgmt_cli output
• base64 -id (after the |) decodes the base64 

There are other ways to achieve this that don't involve the API as well.