- Products
- Learn
- Local User Groups
- Partners
- More
CheckMates Fifth Birthday
Celebrate with Us!
days
hours
minutes
seconds
Join the CHECKMATES Everywhere Competition
Submit your picture to win!
Check Point Proactive support
Free trial available for 90 Days!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
The 2022 MITRE Engenuity ATT&CK®
Evaluations Results Are In!
Now Available: SmartAwareness Security Training
Training Built to Educate and Engage
MITRE ATT&CK
Inside Check Point products!
CheckFlix!
All Videos In One Space
Hi
I was thinking if there have been any considerations of inplementing any was to reset vpn tunnel via th mgmt API interface?
Heiko Ankenbrand did provide a great hint to to use vpn tu via commandline.
https://community.checkpoint.com/docs/DOC-3021-show-vpn-routing-on-cli
Commands are:
vpn tu del ipsec all
vpn tu del ipsec ip-addr
vpn tu del ipsec ip-addr username
vpn tu del all
vpn tu del ip-addr
vpn tu del ip-addr username
I was thinking since smart monitor can do this from the manager why not also being able to do so from the mgmt API?
We have a lot if ipsec vpn which on Remote site have a lte router in front of a Cisco router. This LTE router being reset daily at midnight but due to missing dead Peer detection old sessions not being reset after reboot of the LTE router.
This cause sometimes we manually need to reset vpn tunnels.
This we would like to deligate to users who are not firewall experts, and do not want to allow them smart monitor or expert access.
Therefore we would like to build a portal where they can login and check connection status’s and reset vpn id wanted.
Would that we easy to implement and easy to solve?
Thanks
Best regards
Kim
Tomer Sole, we should add this to API future developments list, per product owner.
Robert.
This might be useful for the gateway API currently under development (i.e. where you will be able to query the gateway directly with REST API).
Sounds nice. I will talk with VPN guys, offer them the i/s.
There could be more useful commands, the whole "vpn" binary.
Thanks
you can do that today using run-script API.
Thanks Tom
But then I will need to use those scripts to parse via mgmt smartconsole.
If I would my own website for internal use I will have to:
This have to be done either vi asp .net or php and before that I would need to find the peer that might have an issue.
What I was thinking talking from smart monitor.
You got some kind of ping running showing the connection is open.
And you have the name of the vpn community as well as the peer address
If it was a API entry in Json I would being able to request these informations in a couple of requests.
That's true. With R80.10 Management API you can only send all VPN calls to one place (the Management) rather than login to every gateway.
It is fantastic to see Gaia API is now in GA.
I have already checked it out and I see a great potential of providing API to Secure gateways.
What I have looking for a long time is to include VPN shell functionality into the Gaia API.
Did not see the features available yet but have been in dialog with Alexander Kim if it could be included in a feature roadmap release and that was possible.
This is my idea basically.
To include the CLISH VPN shell and tu commands into the API. I have been freely translating how a possible API for this method fundation could look like.
https://{{ip}}/gaia_api/vpn/show-tunnels-ike (features show all peers, or peers ip)
https://{{ip}}/gaia_api/vpn/show-tunnels-IPsec (features show all peers, or peers ip)
https://{{ip}}/gaia_api/vpn/delete-ipsec-tunnel-all
https://{{ip}}/gaia_api/vpn/delete-ipsec-tunnel-peer
https://{{ip}}/gaia_api/vpn/delete-ipsec-peer-username
https://{{ip}}/gaia_api/vpn/delete-all-tunnels
https://{{ip}}/gaia_api/vpn/delete-peer-username
Any order ideas?
Thanks
Kim
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY