cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Ivan_Moore
Nickel

Is there a way to do a policy verify and get a full list of verification errors?

By default the verify process only returns ~20'sh verify errors.  Is there a way to get it to return everything?  

14 Replies
Danny
Pearl

Re: Is there a way to do a policy verify and get a full list of verification errors?

There is definitely a way depending on the version you are using. Which is it?

R80.10 has a Management API which offers policy verification.

Example:

mgmt_cli verify-policy policy-package "standard" --version 1.1 --format json‍
0 Kudos
Employee+
Employee+

Re: Is there a way to do a policy verify and get a full list of verification errors?

Yes, there is a way to verify policy with mgmt_cli, but does that give ALL errors as Ivan asked. Haven't tested it with a policy with lots of verification errors.

0 Kudos
Danny
Pearl

Re: Is there a way to do a policy verify and get a full list of verification errors?

You are Check Point's lead consultant in Seattle. Tell us.

0 Kudos
Employee+
Employee+

Re: Is there a way to do a policy verify and get a full list of verification errors? 

I'm not an SE and not in Finland. The Lead part was correct. 🙂 I though you had tested it and that's why I asked. As I said I don't have a management in my lab with a lot of verification errors to test right now.

0 Kudos
Danny
Pearl

Re: Is there a way to do a policy verify and get a full list of verification errors?

Corrected. I know one can put the SmartCenter into debug mode (sk44338) and see all verification errors under $FWDIR/log but I hoped Ivan would respond more swift to know which version he uses and figure out the next relevant steps.

Ivan_Moore
Nickel

Re: Is there a way to do a policy verify and get a full list of verification errors?

I am not sure what API version, but the api call you reference returns the same results as running it via SmartConsole.   

0 Kudos
Employee+
Employee+

Re: Is there a way to do a policy verify and get a full list of verification errors?

This is my understanding as well that API should always return the same output as SmartConsole.

Re: Is there a way to do a policy verify and get a full list of verification errors?

performing the verify-policy from Postman with web-session API call the only response I receive is a task-id.  I need to then look at the task-id to see the results of the verification.

Re: Is there a way to do a policy verify and get a full list of verification errors?

Currently we tried to balance verification errors performance with detail. So often times we "fail fast" rather than give a full list of errors that can take a while. So this thread is a good feedback.

Please note that with R80 and above, some of the things that used to fail at the "verify policy" process are now instant and live as the users make the change, blocking them from publishing the change.

Ivan_Moore
Nickel

Re: Is there a way to do a policy verify and get a full list of verification errors?

I totally get failing fast.  It makes sense.  It would be quite useful to have a option/flag/something that could be passed to have the process not fail fast and provide everything.  

0 Kudos
Admin
Admin

Re: Is there a way to do a policy verify and get a full list of verification errors?

Which of course doesn't help if there was a bug in the policy validation logic previously Smiley Happy

0 Kudos

Re: Is there a way to do a policy verify and get a full list of verification errors?

I would suggest the procedure(s) from sk44338 How to debug Policy Verification.

Re: Is there a way to do a policy verify and get a full list of verification errors?

adding verbose logs will not increase the amount of verification checks....

0 Kudos
Highlighted

Re: Is there a way to do a policy verify and get a full list of verification errors? 

Yes, that is a pity!

0 Kudos