Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
IdentityUnknown
Contributor
Jump to solution

Adding Rules to a Rule Section Using Ansible

Dear all,

we are using the Check Point Ansible module https://github.com/CheckPointSW/cpAnsible

 

Do you know how to group access rules below a section?

The API tells me:

https://sc1.checkpoint.com/documents/latest/APIs/#cli/add-access-rule~v1.5%20

But how to convert it to an ansible playbook?

Only the "position: "top"" statement seems to be working. I commented the other attempts out.

Any ideas?

 

 

  - name: "Section"
    check_point_mgmt:
      command: add-access-section
      parameters:
        layer: "Network"
		name: "section 1"
        position: "top"
      session-data: "{{login_response}}"

  - name: "Rule"
    check_point_mgmt:
      command: add-access-rule
      parameters:
        layer: "Network"
#        position.below: "section 1"
#		 position: "section 1"
        position: "top"
        name: "Access rule"
        source: "1.1.1.1"
        destination: "2.2.2.2"
        service: "ssh"
        action: "allow"
      session-data: "{{login_response}}"

 

 

Thank you & kind regards

0 Kudos
2 Solutions

Accepted Solutions
PhoneBoy
Admin
Admin

My guess is you need to do something like:

 

  - name: "Rule"
    check_point_mgmt:
      command: add-access-rule
      parameters:
        layer: "Network"
        position:
          below: "section 1"
        name: "Access rule"
        source: "1.1.1.1"
        destination: "2.2.2.2"
        service: "ssh"
        action: "accept"
      session-data: "{{login_response}}"

 

View solution in original post

Maik
Advisor

I'm no expert when it comes to Ansible, but my guess is that the parameter for the action statement should be "accept" instead of "allow" - as mentioned in the API documentation:

 

actionstring
Default: Drop
"Accept", "Drop", "Ask", "Inform", "Reject", "User Auth", "Client Auth", "Apply Layer".

View solution in original post

7 Replies
PhoneBoy
Admin
Admin
What error do you get?
0 Kudos
IdentityUnknown
Contributor

With the following task:

  - name: "Rule"
    check_point_mgmt:
      command: add-access-rule
      parameters:
        layer: "Network"
        position.below: "section 1"
        name: "Access rule"
        source: "1.1.1.1"
        destination: "2.2.2.2"
        service: "ssh"
        action: "allow"
      session-data: "{{login_response}}"

 

I got

 "msg": "Command 'add-access-rule {u'layer': u'Network', u'name': u'Access rule', u'service': u'ssh', u'destination': u'2.2.2.2', u'position.below': u'section 1', u'source': u'1.1.1.1', u'action': u'allow'}' failed with error message: message: Unrecognized parameter [position.below]\ncode: generic_err_invalid_parameter_name\n. All changes are discarded and the session is invalidated."

 

0 Kudos
PhoneBoy
Admin
Admin

My guess is you need to do something like:

 

  - name: "Rule"
    check_point_mgmt:
      command: add-access-rule
      parameters:
        layer: "Network"
        position:
          below: "section 1"
        name: "Access rule"
        source: "1.1.1.1"
        destination: "2.2.2.2"
        service: "ssh"
        action: "accept"
      session-data: "{{login_response}}"

 

IdentityUnknown
Contributor

I tried it as well before, but the statement is reordered (position at the end of the statement) and the exception is:

msg": "Command 'add-access-rule {u'layer': u'Network', u'name': u'Access rule', u'service': u'ssh', u'destination': u'2.2.2.2', u'source': u'1.1.1.1', u'action': u'allow', u'position': {u'below': u'section 1'}}' failed with error message: message: Invalid parameter for [action]. The invalid value: [allow]\ncode: generic_err_invalid_parameter\n. All changes are discarded and the session is invalidated."

 

0 Kudos
Maik
Advisor

I'm no expert when it comes to Ansible, but my guess is that the parameter for the action statement should be "accept" instead of "allow" - as mentioned in the API documentation:

 

actionstring
Default: Drop
"Accept", "Drop", "Ask", "Inform", "Reject", "User Auth", "Client Auth", "Apply Layer".
IdentityUnknown
Contributor

Yes, I worked with a typo in my example playbook. 

The task is working as PhoneBoy mentioned with the action string "accept" which Maik mentioned.

 

Thank you!

 

0 Kudos
PhoneBoy
Admin
Admin
All I did was propagate the original mistake, fixed in my answer.
0 Kudos
Upcoming Events

    CheckMates Events