Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 

IPs to Rules as JSON or CSV

Bob_Zimmerman
Authority
Authority

I recently had the need to build a table out of all of the rules referencing any IP address in a list of addresses. Basically a rule audit for all the rules involved in a given application.

This post originally had several versions of the script attached directly, but I have since moved it to Github:

https://github.com/Bob-Zimmerman/ipsToRulesCP

ipsToRules.png

 

USAGE

The script should be run as root (in expert mode, and with elevated privileges if you use low-privilege users) on

...;
TO ACCESS CHECKMATES TOOLBOX it's simple and free

Disclaimer: Check Point does not provide maintenance services or technical or customer support for third party content provided on this Site, including in CheckMates Toolbox. See also our Third Party Software Disclaimer.




6 Replies

Bob_Zimmerman
Authority
Authority

New version is available.

CHANGES

  • Added object UID output to dereferencer failures to help find the object in question and write a new dereferencer case.
  • Added four object types to the object dereferencer (service-other, CpmiHostCkp, address-range, Internet).
  • Normalized multi-line pipeline styling.
  • Fixed object dereferencer handling for spaces in object names.
;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


Bob_Zimmerman
Authority
Authority

New version is available.

CHANGES

  • Rearranged dereferencer objects to case-insensitive alphabetical order.
  • Added more types to the dereferencer (group-with-exclusion, service-dce-rpc)
  • Added basic object output for dereferencer failures.
;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


Bob_Zimmerman
Authority
Authority

New version is available. I think this one is a pretty significant update.

Changes

  • Added CpmiGatewayPlain to the dereferencer.
  • Updated most of my sed scripts to use ASCII Unit Separators rather than # for the field separation. This is important because Unit Separator is a non-printing character. It can't naturally occur in the comments of an object, which enables the next feature:
  • Added object comments to dereferencer output.
;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

Bob_Zimmerman
Authority
Authority

I have decided to start pushing this script to Github:

https://github.com/Bob-Zimmerman/ipsToRulesCP

I will try to share major changes here, but smaller changes will only show up there. If you look at the commit history, you may see I have broken down the changes in a more granular way than I did here. The prior batches of changes were to avoid forum noise by only posting when I felt there were somewhat significant updates. Version control systems like Git, however, are really built w

...;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

PhoneBoy
Admin
Admin

@_Val_ looks like a Toolbox addition. 

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

Bob_Zimmerman
Authority
Authority

Actually, this reminded me. Some time last year, I did get around to testing whether you can make a cyclic set of groups (group A contains group B, group B contains group A), and confirmed the management won't let you. Removed that concern from the known limitations!

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos