Bash application to find and fix conflicting rules in a SMS

[tomshw]

Hello all,

Sharing my solution for the issue where trying to install a huge policy with more then 13 conflicting rules and getting:
{
  "tasks" : [ {
    "task-id" : "0123....",
    "task-name" : "Verify policy operation",
    "status" : "failed",
    "progress-percentage" : 100,
    "suppressed" : false,
    "task-details" : [ {
      "workSession" : "34e7.....",
      "title" : "Verification of policy 'K....' completed with errors",
      "notifications" : [ ],
      "warnings" : [ ],
      "errors" : [ "Error: Layer ......."    Too many errors." ]
    } ]
  } ]
}

Documentation:

# =============================================================================
# Check Point Rulebase Overlap & Validation Fixer
# Version: 2.0
#
# Identifies and optionally disables:
# 1. Rules failing policy verification (via verify-policy API)
# 2. Exact duplicate rules (same source/dest/service/action)
# 3. Conflicting rules (overlapping traffic, opposite terminal actions)
# 4. Shadowed rules (entirely covered by a preceding Any/Any/Any rule)
# 5. Rules with empty source/destination/service
#
# MODES:
# Default (dry-run) : Analyse and report only — no changes made
# --disable : Disable flagged rules and publish the session
#
# USAGE:
# ./rulebase_cleanup.sh [OPTIONS]
#
# OPTIONS:
# -H, --host HOST Management server IP/hostname (default: 127.0.0.1)
# -u, --user USER API username (default: admin)
# -p, --pass PASS API password (prompted if omitted)
# -r, --root Use local root credentials, no user/pass needed
# -P, --policy NAME Policy package name (default: Standard)
# -l, --layer NAME Access layer name (default: Network)
# --disable Actually disable flagged rules (default: dry-run)
# --skip-verify Skip the verify-policy API call (faster re-runs)
# --rules-file FILE Use an existing rules_raw.json (skip fetch)
# -h, --help Show this help
#
# REQUIREMENTS:
# - Run on the Check Point Management Server (SMS)
# - mgmt_cli must be in PATH
# - jq must be installed (yum install jq)
# - Python 3
#
# OUTPUT FILES (written to ./cp_cleanup_<timestamp>/):
# rules_raw.json All rules fetched from the API
# validation_errors.json verify-policy raw output
# validation_issues.json Parsed conflict/warning list from verify-policy
# overlap_analysis.json Duplicates, conflicts, shadows from analysis
# all_issues.json Merged, deduplicated findings
# flagged_rules.txt UIDs to disable
# cleanup_report.txt Human-readable summary
# =============================================================================