Newbie question about mgmt_cli on windows

[pgestido]

Hi:

I am trying to use mgmt_cli on Windows to connect to Smart1 Cloud

I am trying to use 

mgmt_cli -m mydomain.maas.checkpoint.com --context <context-id>/web_api login api-key <my_api_key> > id.txt

this generate the id.txt like 

uid: "my_uid"
sid: "my_sid"
url: "https://127.0.0.1:443/web_api"
session-timeout: 600
last-login-was-at:
posix: 1732049229199
iso-8601: "2024-11-19T20:47+0000"
api-server-version: "1.9.1"
user-name: "admin-api"
user-uid: "my_user-uid"

next, I try

mgmt_cli -m mydomain.maas.checkpoint.com --context <context-id>/web_api show networks --session-file id.txt

and get the following error:

Couldn't connect to server
If you need to use a proxy server, add the '--proxy' parameter

But if I execute 

mgmt_cli -m mydomain.maas.checkpoint.com --context <context-id>/web_api show networks --session-id "my_sid"

this works fine.

All examples I found on the web are done like the first option.

What am I doing wrong?

Regards,

Pablo

[PhoneBoy]

My understanding is that you do not need -m or --context if you are using a session file, as all of the necessary information should be included.

[pgestido]

Hi:

I tried without -m and -s and still having the same issue (previously generated a new session file)

mgmt_cli show networks -s id.txt
Couldn't connect to server
If you need to use a proxy server, add the '--proxy' parameter

is it that in "id.txt" the url points to localhost (127.0.0.1) 

[Duane_Toler · Accepted solution]

Hmm ..he might have a point here.  I tried the same thing to a customer's Smart-1 Cloud and got what he got.  When using -s for a session file with Smart-1 Cloud, the URL is to localhost and that breaks it.  This only for S1C, tho.

@pgestido: You'll need use get the "sid" string from that session file and set that to your environment variable named MGMT_CLI_SESSION_ID.

With Smart-1 Cloud, preferably you would use an API key for authentication.  You can set that with MGMT_CLI_API_KEY=<api key string>.  But if you are using a username/password and it works, then you can do that.

You also need to set a few more:

MGMT_CLI_MANAGEMENT=mydomain.maas.checkpoint.com

MGMT_CLI_CONTEXT=<context-id>/web_api

From here, you can do "mgmt_cli login" (no other parameters needed, if you use the environment variables) .  You can add --unsafe-auto-accept true to avoid having to accept the fingerprint manually.  After you login, copy the "sid" string and set that to the variable:

MGMT_CLI_SESSION_ID=<sid string>

Next, you need to un-set the MGMT_CLI_API_KEY variable.  From here on out, the session ID string holds the link to the login session.

When you're done, you can do "mgmt_cli logout", then destroy all those variables.  I don't quite remember all of the incantations to do this on Windows, but you can take it from here.

Let us know if you still need help.

[pgestido]

Thanks @Duane_Toler this worked fine.

They key is unsetting the MGMT_CLI_API_KEY var, then setting the MGMT_CLI_SESSION_ID var (with the help of jq for Windows)

I am developing a .bat script with this info. I will share it once it is finished.

Regards,

Pablo

[pgestido]

After taking Tim Hall's CCAS (and with your help) I managed to write a small (.bat) piece of code where you can insert your own code.

I had the challenge to (sometimes) apply policy in about 40 Gws.

With this script I can do it

Thanks @Duane_Toler  and @PhoneBoy 

Just rename the file as .bat and run it.

Enjoy !!!!

[Duane_Toler]

Yep, that's it.  BTW - You should look into building yourself a container image to run Ansible if you have that many gateways.  It's more scalable, more consistent, and easier tracking [for compliance and evidence trail].  You can run Docker on Windows and map your Windows folders to volumes inside the container.  You might need to run dos2unix on the files, however, or else things can get "weird" unexpectedly.

[Shameless plug]  Check the series in my sig line to get you started.  I have an episode on getting started with Docker and git, along with a link to the Dockerfile I used to build my container.  I also dedicated one episode to building the inventory for various types of management servers.  Hope it helps!

[pgestido]

Hi Duane I made the script for "academic reasons", just to get to know how easy /difficult is to build this kind of scripts and also to try to get some help with repetitive task. Since my team manages about 40 Checkpoint, just imagine the work that is to change one object and having to appliy policies in all the Gws .......

I have started to watch your video series .... I am on the third video ..... good work.

Regards,

Pablo

[Duane_Toler]

Thanks!

You definitely will want that type academic info!  You can still use that knowledge to build yourself some custom scripts for some targeted cases like giving yourself a quick way to search for, and show, objects or access rules or logs, ... lots of things.  Keep at it! My needs for SmartConsole continue dwindling by the day and I'm not sad about that. 🙂

Check out the API commands like "show-hosts" and "show-networks" with the option "filter ...".

mgmt_cli show-hosts filter "domain controller"
mgmt_cli show-networks filter "some comment substring"

Another tip: In your script, you can use "set MGMT_CLI_FORMAT=json" and not have to always use "-f json"  [or "--format json"] on each command.

FYI, if you don't know yet, the JQ documentation is available at https://jqlang.org/.  Be sure to select the version that you have on your host (which is likely NOT the same as the one on the management server).

Keep up the work and experimentation!