http://www.cpwiki.net/api.php?action=feedcontributions&feedformat=atom&user=Nighthawk
cpwiki.net - User contributions [en]
2026-04-29T08:23:52Z
User contributions
MediaWiki 1.21.10
http://www.cpwiki.net/index.php/cpuse_deployment_agent
cpuse deployment agent
2026-03-29T02:23:08Z
<p>Nighthawk: </p>
<hr />
<div>==checking current version==<br />
# clish -c "show installer status build"<br />
Build number: 2084 (agent build is up to date)<br />
<br />
==downloading the latest cpuse deployment agent==<br />
<br />
a download link to the latest cpuse is found in [https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449&partition=General&product=All%22 sk92449] on the user center<br />
<br />
==check currently installed version==<br />
<br />
cpvinfo $DADIR/bin/DAService | grep Build<br />
<br />
==how do perform and offline upgrades==<br />
<br />
# download the latest cpuse<br />
# uninstall cpuse<br />
[Expert@chkpmds1:0]# '''rpm -e CPda-00-00'''<br />
/opt/CPshrd-R77/bin/cpwd_admin del -name DASERVICE<br />
cpwd_admin: <br />
successful Del operation<br />
<br />
# install new cpuse<br />
<br />
Expert@chkpmds1:0]# '''rpm -ivh ./CPda-00-00.i386.rpm''' <br />
Preparing... ########################################### [100%]<br />
cpwd_admin: <br />
Process DASERVICE isn't monitored by cpWatchDog. Stop request aborts <br />
Trying to stop DAService for 60 seconds - please wait...<br />
Error: DAService is not running.<br />
<br>Waiting for DAService to stop...<br />
Error: DAService is not running.<br />
<br />
*** note: it is typical to see the above message many times<br />
<br />
== restarting clishd==<br />
<br />
To Stop [Expert@HostName]# '''tellpm process:clishd'''<br />
<br>To Start [Expert@HostName]# '''tellpm process:clishd t'''<br />
<br />
start agent<br />
<br />
# clish -c "installer agent start"<br />
<br />
upgrade should be completed.</div>
Nighthawk
http://www.cpwiki.net/index.php/growing_root_partition
growing root partition
2025-10-25T02:21:56Z
<p>Nighthawk: /* Solution */</p>
<hr />
<div><br />
== Problem ==<br />
<br />
insufficient disk space in /opt to apply an upgrade. <br />
<br />
O.S. : secure platform (splat) or gaia<br />
<br />
Check Point versions: multiple<br />
<br />
<br />
== Solution ==<br />
<br />
Use available, unallocated disk space. Newer Check Point version use LVM. Check Point often doesn't allocate it all. This not a bad thing. It is a common, best practice with LVM. This allows admins to easily grow partitions as needed using the free disk space. If you allocated it all up front, but needed one partition bigger, you would have to shrink one to grow another. This is more complicated. With root, it can't be shrunk while the system is running(it can be grown as we are about to see).<br />
<br />
'''Example'''<br />
<br />
[Expert@chkpfw1:0]# '''df -h'''<br />
Filesystem Size Used Avail Use% Mounted on<br />
/dev/mapper/vg_splat-lv_current<br />
4.9G 3.6G 1.1G 77% / <<< root does't have enough space for my 77.30 upgrade :(<br />
/dev/hda1 289M 24M 251M 9% /boot<br />
tmpfs 217M 0 217M 0% /dev/shm<br />
/dev/mapper/vg_splat-lv_log<br />
6.8G 3.7G 2.9G 57% /var/log<br />
<br />
<br />
Check the volumn groups for Free space<br />
<br />
[Expert@chkpfw2:0]# '''vgdisplay | grep -i size'''<br />
VG Size 18.69 GB<br />
PE Size 32.00 MB<br />
Alloc PE / Size 384 / 12.00 GB<br />
Free PE / Size 214 / 6.69 GB <<< yay! I have some!<br />
<br />
<br />
adding/growing the logical volume "container"<br />
<br />
[Expert@chkpfw2:0]# '''lvresize -L +6.69GB vg_splat/lv_current'''<br />
Rounding up size to full physical extent 6.72 GB<br />
Extending logical volume lv_current to 11.72 GB<br />
Insufficient free space: 215 extents needed, but only 214 available<br />
<br />
that failed... specifying the increase in GB is less precise. So, lets use "extents"<br />
<br />
[Expert@chkpfw2:0]# '''lvresize -l +214 vg_splat/lv_current'''<br />
Extending logical volume lv_current to 11.69 GB<br />
Logical volume lv_current successfully resized<br />
<br />
verifying new volume group size<br />
<br />
[Expert@chkpfw2:0]# vgdisplay | grep -i -E "name|size"<br />
VG Name vg_splat<br />
VG Size 18.69 GB<br />
PE Size 32.00 MB<br />
Alloc PE / Size 598 / 18.69 GB<br />
Free PE / Size 0 / 0<br />
<br />
growing the file system to fill the "container"<br />
<br />
[Expert@chkpfw2:0]# '''resize2fs /dev/mapper/vg_splat-lv_current'''<br />
resize2fs 1.39 (29-May-2006)<br />
Filesystem at /dev/mapper/vg_splat-lv_current is mounted on /; on-line resizing required<br />
Performing an on-line resize of /dev/mapper/vg_splat-lv_current to 3063808 (4k) blocks.<br />
The filesystem on /dev/mapper/vg_splat-lv_current is now 3063808 blocks long.<br />
<br />
newer Gaia O.S. implementations utilize xfs file systems. resize2fs won't work. use xfs_growfw instead<br />
<br />
[Expert@chkpfw2:0]# '''xfs_growfs /dev/mapper/vg_splat-lv_current'''<br />
meta-data=/dev/mapper/vg_splat-lv_log isize=512 agcount=4, agsize=2097152 blks<br />
= sectsz=512 attr=2, projid32bit=1<br />
= crc=1 finobt=0 spinodes=0<br />
data = bsize=4096 blocks=8388608, imaxpct=25<br />
= sunit=0 swidth=0 blks<br />
naming =version 2 bsize=4096 ascii-ci=0 ftype=1<br />
log =internal bsize=4096 blocks=4096, version=2<br />
= sectsz=512 sunit=0 blks, lazy-count=1<br />
realtime =none extsz=4096 blocks=0, rtextents=0<br />
data blocks changed from 8388608 to 31981568<br />
<br />
<br />
viewing newly allocated disk space<br />
<br />
[Expert@chkpfw2:0]# df -h<br />
Filesystem Size Used Avail Use% Mounted on<br />
/dev/mapper/vg_splat-lv_current<br />
12G 3.6G 7.2G 33% /<br />
/dev/hda1 289M 24M 251M 9% /boot<br />
tmpfs 217M 0 217M 0% /dev/shm<br />
/dev/mapper/vg_splat-lv_log<br />
6.8G 2.2G 4.3G 34% /var/log<br />
<br />
So, we grew root while the system had it mounted and was running from it. Thank you LVM!</div>
Nighthawk
http://www.cpwiki.net/index.php/growing_root_partition
growing root partition
2025-10-25T02:21:23Z
<p>Nighthawk: /* Solution */</p>
<hr />
<div><br />
== Problem ==<br />
<br />
insufficient disk space in /opt to apply an upgrade. <br />
<br />
O.S. : secure platform (splat) or gaia<br />
<br />
Check Point versions: multiple<br />
<br />
<br />
== Solution ==<br />
<br />
Use available, unallocated disk space. Newer Check Point version use LVM. Check Point often doesn't allocate it all. This not a bad thing. It is a common, best practice with LVM. This allows admins to easily grow partitions as needed using the free disk space. If you allocated it all up front, but needed one partition bigger, you would have to shrink one to grow another. This is more complicated. With root, it can't be shrunk while the system is running(it can be grown as we are about to see).<br />
<br />
'''Example'''<br />
<br />
[Expert@chkpfw1:0]# '''df -h'''<br />
Filesystem Size Used Avail Use% Mounted on<br />
/dev/mapper/vg_splat-lv_current<br />
4.9G 3.6G 1.1G 77% / <<< root does't have enough space for my 77.30 upgrade :(<br />
/dev/hda1 289M 24M 251M 9% /boot<br />
tmpfs 217M 0 217M 0% /dev/shm<br />
/dev/mapper/vg_splat-lv_log<br />
6.8G 3.7G 2.9G 57% /var/log<br />
<br />
<br />
Check the volumn groups for Free space<br />
<br />
[Expert@chkpfw2:0]# '''vgdisplay | grep -i size'''<br />
VG Size 18.69 GB<br />
PE Size 32.00 MB<br />
Alloc PE / Size 384 / 12.00 GB<br />
Free PE / Size 214 / 6.69 GB <<< yay! I have some!<br />
<br />
<br />
adding/growing the logical volume "container"<br />
<br />
[Expert@chkpfw2:0]# '''lvresize -L +6.69GB vg_splat/lv_current'''<br />
Rounding up size to full physical extent 6.72 GB<br />
Extending logical volume lv_current to 11.72 GB<br />
Insufficient free space: 215 extents needed, but only 214 available<br />
<br />
that failed... specifying the increase in GB is less precise. So, lets use "extents"<br />
<br />
[Expert@chkpfw2:0]# '''lvresize -l +214 vg_splat/lv_current'''<br />
Extending logical volume lv_current to 11.69 GB<br />
Logical volume lv_current successfully resized<br />
<br />
verifying new volume group size<br />
<br />
[Expert@chkpfw2:0]# vgdisplay | grep -i -E "name|size"<br />
VG Name vg_splat<br />
VG Size 18.69 GB<br />
PE Size 32.00 MB<br />
Alloc PE / Size 598 / 18.69 GB<br />
Free PE / Size 0 / 0<br />
<br />
growing the file system to fill the "container"<br />
<br />
[Expert@chkpfw2:0]# '''resize2fs /dev/mapper/vg_splat-lv_current'''<br />
resize2fs 1.39 (29-May-2006)<br />
Filesystem at /dev/mapper/vg_splat-lv_current is mounted on /; on-line resizing required<br />
Performing an on-line resize of /dev/mapper/vg_splat-lv_current to 3063808 (4k) blocks.<br />
The filesystem on /dev/mapper/vg_splat-lv_current is now 3063808 blocks long.<br />
<br />
newer Gaia O.S. implementations utilize xfs file systems. resize2fs won't work. use xfs_growfw instead<br />
<br />
[Expert@chkpfw2:0]# '''xfs_growfs /dev/mapper/vg_splat-lv_current'''<br />
meta-data=/dev/mapper/vg_splat-lv_log isize=512 agcount=4, agsize=2097152 blks<br />
= sectsz=512 attr=2, projid32bit=1<br />
= crc=1 finobt=0 spinodes=0<br />
data = bsize=4096 blocks=8388608, imaxpct=25<br />
= sunit=0 swidth=0 blks<br />
naming =version 2 bsize=4096 ascii-ci=0 ftype=1<br />
log =internal bsize=4096 blocks=4096, version=2<br />
= sectsz=512 sunit=0 blks, lazy-count=1<br />
realtime =none extsz=4096 blocks=0, rtextents=0<br />
data blocks changed from 8388608 to 31981568<br />
<br />
<br />
viewing newly allocated disk space<br />
<br />
[Expert@chkpfw2:0]# df -h<br />
Filesystem Size Used Avail Use% Mounted on<br />
/dev/mapper/vg_splat-lv_current<br />
12G 3.6G 7.2G 33% /<br />
/dev/hda1 289M 24M 251M 9% /boot<br />
tmpfs 217M 0 217M 0% /dev/shm<br />
/dev/mapper/vg_splat-lv_log<br />
6.8G 2.2G 4.3G 34% /var/log<br />
<br />
So, we grew root while the system had it mounted and was running from it. Thank you LVM!</div>
Nighthawk
http://www.cpwiki.net/index.php/First_time_config_%22wizard%22_via_CLI_mode
First time config "wizard" via CLI mode
2025-10-24T14:26:10Z
<p>Nighthawk: Created page with " == Creating a configuration file == # '''config_system -t <File Name>''' === configuration file validation === # config_system --config-file <File Name> --dry-run == run..."</p>
<hr />
<div><br />
<br />
== Creating a configuration file ==<br />
# '''config_system -t <File Name>'''<br />
<br />
=== configuration file validation ===<br />
# config_system --config-file <File Name> --dry-run<br />
<br />
== running config with template file ==<br />
# config_system -f <File Name></div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2025-10-14T15:17:35Z
<p>Nighthawk: /* logging */</p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
===configure===<br />
example<br />
# config system interface<br />
# edit port1<br />
# set mode static<br />
# set ip 10.1.1.1 255.255.255.0<br />
# next<br />
# end<br />
<br />
===get info==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
or just leave the line out.<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
verbosity of 4 will show the port name<br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
==default login==<br />
<br />
VM images = admin / (empty password)<br />
<br />
==logging==<br />
[https://community.fortinet.com/t5/FortiGate/Technical-Tip-Displaying-logs-via-FortiGate-s-CLI/ta-p/193027 Displaying logs via FortiGate's CLI]<br />
<br />
set log filter to view category with traffic logs<br />
execute log filter category 0<br />
set log filter to view logs from local disk<br />
execute log filter device 0<br />
view log filter settings<br />
execute log filter dump<br />
reset log filter<br />
execute log filter reset<br />
example..<br />
<br />
execute log filter category 0<br />
execute log filter device 0<br />
execute log filter field srcip 10.0.0.10<br />
execute log filter field dstip 192.168.1.1<br />
execute log display<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2025-08-13T17:29:20Z
<p>Nighthawk: </p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
===configure===<br />
example<br />
# config system interface<br />
# edit port1<br />
# set mode static<br />
# set ip 10.1.1.1 255.255.255.0<br />
# next<br />
# end<br />
<br />
===get info==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
or just leave the line out.<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
verbosity of 4 will show the port name<br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
==default login==<br />
<br />
VM images = admin / (empty password)<br />
<br />
==logging==<br />
[https://community.fortinet.com/t5/FortiGate/Technical-Tip-Displaying-logs-via-FortiGate-s-CLI/ta-p/193027 Displaying logs via FortiGate's CLI]<br />
<br />
set log filter to view category with traffic logs<br />
execute log filter category 0<br />
set log filter to view logs from local disk<br />
execute log filter device 0<br />
view log filter settings<br />
execute log filter dump<br />
reset log filter<br />
execute log filter reset<br />
example..<br />
<br />
execute log filter category 0<br />
execute log filter device 0<br />
execute log filter srcip 10.0.0.10<br />
execute log filter dstip 192.168.1.1<br />
execute log display<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/big-ip_notes
big-ip notes
2025-05-13T16:20:59Z
<p>Nighthawk: </p>
<hr />
<div><br />
get pool membership by node IP via CLI<br />
# '''tmsh -q -c "cd /; list ltm pool one-line recursive" | grep <ip address>'''<br />
<br />
==links==<br />
<br />
[https://community.f5.com/kb/codeshare/big-ip-upgrade-procedure-using-cli-vcmp-guest--host/280685 BIG-IP Upgrade Procedure Using CLI (vCMP Guest & Host)]<br />
<br />
[https://networkproguide.com/f5-big-ip-cli-commands-cheat-sheet/ Big-ip cheat sheet]<br />
[[category:f5]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_create_api_user_via_CLI
fortinet create api user via CLI
2025-04-28T17:20:15Z
<p>Nighthawk: Created page with " To create a REST API administrator in the CLI: config system api-user edit "api-admin" set comments <string> set api-key ************ set acc..."</p>
<hr />
<div><br />
<br />
<br />
To create a REST API administrator in the CLI:<br />
<br />
<br />
config system api-user<br />
edit "api-admin"<br />
set comments <string><br />
set api-key ************<br />
set accprofile "API profile"<br />
set vdom "root"<br />
set peer-auth enable<br />
set peer-group <group><br />
config trusthost<br />
edit 1<br />
set ipv4-trusthost <class_ip&net_netmask><br />
next<br />
...<br />
end<br />
next<br />
end<br />
<br />
Generate the API token:<br />
<br />
# execute api-user generate-key <API username><br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_downloads
fortinet downloads
2025-04-21T21:48:27Z
<p>Nighthawk: </p>
<hr />
<div>https://support.fortinet.com/Download/FirmwareImages.aspx<br />
<br />
[[category: fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2025-03-29T14:30:04Z
<p>Nighthawk: /* packet capture */</p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
===configure===<br />
example<br />
# config system interface<br />
# edit port1<br />
# set mode static<br />
# set ip 10.1.1.1 255.255.255.0<br />
# next<br />
# end<br />
<br />
===get info==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
or just leave the line out.<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
verbosity of 4 will show the port name<br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
==default login==<br />
<br />
VM images = admin / (empty password)<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2025-03-29T14:29:46Z
<p>Nighthawk: </p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
===configure===<br />
example<br />
# config system interface<br />
# edit port1<br />
# set mode static<br />
# set ip 10.1.1.1 255.255.255.0<br />
# next<br />
# end<br />
<br />
===get info==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
or just leave the line out.<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
&nbsp;verbosity of 4 will show the port name<br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
==default login==<br />
<br />
VM images = admin / (empty password)<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2025-03-29T14:29:09Z
<p>Nighthawk: /* packet capture */</p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
===configure===<br />
example<br />
# config system interface<br />
# edit port1<br />
# set mode static<br />
# set ip 10.1.1.1 255.255.255.0<br />
# next<br />
# end<br />
<br />
===get info==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
or just leave the line out.<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
&nbsp;verbosity of 4 will show the port name<br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
==default login==<br />
<br />
VM images = admin / (empty password)<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2025-03-29T14:28:20Z
<p>Nighthawk: /* packet capture */</p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
===configure===<br />
example<br />
# config system interface<br />
# edit port1<br />
# set mode static<br />
# set ip 10.1.1.1 255.255.255.0<br />
# next<br />
# end<br />
<br />
===get info==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
or just leave the line out.<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
&bnspverbosity of 4 will show the port name<br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
==default login==<br />
<br />
VM images = admin / (empty password)<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/API_for_logs_manpage
API for logs manpage
2025-03-26T22:52:11Z
<p>Nighthawk: </p>
<hr />
<div><br />
==For a new logs query==<br />
'''mgmt_cli show-logs new-query.filter product:<product name> new-query.time-frame <time-frame> new-query.max-logs-per-request <limit>'''<br />
<br />
<br />
filter - The filter as entered in SmartConsole/SmartView. Type: String<br />
<br />
time-frame - Specify the time frame to query logs. Type: String<br />
<br />
&nbsp;&nbsp;Valid values: last-7-days last-hour today last-24-hours yesterday this-week this-month last-30-days all-time custom Default: last-7-days<br />
<br />
custom-start - Must be in ISO861 format. Type: String<br />
<br />
custom-end - Must be in ISO861 format. Type: String<br />
<br />
max-logs-per-request - Valid values: 1-100 Default: 10 Type: String<br />
<br />
type - Type of logs to return. Valid values: logs, audit. Default: logs<br />
<br />
log-servers - List of IPs of log servers to query. Default: all<br />
<br />
==To get results for top statistics==<br />
'''mgmt_cli show-logs new-query.filter product:<product name> new-query.top.field blades new-query.top.count <number> --format json -r true'''<br />
<br />
count - Valid values: 1-50<br />
<br />
field - Valid values: sources destinations services actions blades origins users applications<br />
<br />
==To get more results for an existing query==<br />
'''mgmt_cli show-logs query-id <query-id> --session-id <session-id>'''<br />
<br />
query-id - Get the next page of the last run query with a specified limit.<br />
<br />
ignore-warnings - Ignore warnings if they exist. Type: Boolean<br />
<br />
==Limitations==<br />
The parameter "time-frame" in the API command does not accept this format as input:<br />
<br />
&nbsp;&nbsp; yyyymmddThhmmssZ<br />
<br />
The command does not support non-index mode log queries.<br />
<br />
[[category:api]]</div>
Nighthawk
http://www.cpwiki.net/index.php/API_for_logs_manpage
API for logs manpage
2025-03-26T22:41:55Z
<p>Nighthawk: </p>
<hr />
<div> mgmt_cli show-logs new-query.filter product:<product name> new-query.time-frame <time-frame> new-query.max-logs-per-request <limit><br />
<br />
<br />
filter - The filter as entered in SmartConsole/SmartView. Type: String<br />
<br />
time-frame - Specify the time frame to query logs. Type: String<br />
<br />
&nbsp;&nbsp;Valid values: last-7-days last-hour today last-24-hours yesterday this-week this-month last-30-days all-time custom Default: last-7-days<br />
<br />
custom-start - Must be in ISO861 format. Type: String<br />
<br />
custom-end - Must be in ISO861 format. Type: String<br />
<br />
max-logs-per-request - Valid values: 1-100 Default: 10 Type: String<br />
<br />
type - Type of logs to return. Valid values: logs, audit. Default: logs<br />
<br />
log-servers - List of IPs of log servers to query. Default: all</div>
Nighthawk
http://www.cpwiki.net/index.php/API_for_logs_manpage
API for logs manpage
2025-03-26T22:35:54Z
<p>Nighthawk: Created page with " mgmt_cli show-logs new-query.filter product:<product name> new-query.time-frame <time-frame> new-query.max-logs-per-request <limit> filter - The filter as entered in SmartC..."</p>
<hr />
<div> mgmt_cli show-logs new-query.filter product:<product name> new-query.time-frame <time-frame> new-query.max-logs-per-request <limit><br />
<br />
<br />
filter - The filter as entered in SmartConsole/SmartView. Type: String<br />
<br />
time-frame - Specify the time frame to query logs.<br />
<br />
{{spc}}Valid values: last-7-days last-hour today last-24-hours yesterday this-week this-month last-30-days all-time custom Default: last-7-days<br />
<br />
{{spc}}Type: String</div>
Nighthawk
http://www.cpwiki.net/index.php/big-ip_notes
big-ip notes
2024-12-09T17:55:37Z
<p>Nighthawk: </p>
<hr />
<div>==links==<br />
<br />
[https://community.f5.com/kb/codeshare/big-ip-upgrade-procedure-using-cli-vcmp-guest--host/280685 BIG-IP Upgrade Procedure Using CLI (vCMP Guest & Host)]<br />
<br />
[https://networkproguide.com/f5-big-ip-cli-commands-cheat-sheet/ Big-ip cheat sheet]<br />
[[category:f5]]</div>
Nighthawk
http://www.cpwiki.net/index.php/big-ip_notes
big-ip notes
2024-10-04T19:06:57Z
<p>Nighthawk: Created page with "==links== [https://community.f5.com/kb/codeshare/big-ip-upgrade-procedure-using-cli-vcmp-guest--host/280685 BIG-IP Upgrade Procedure Using CLI (vCMP Guest & Host)] category..."</p>
<hr />
<div>==links==<br />
<br />
[https://community.f5.com/kb/codeshare/big-ip-upgrade-procedure-using-cli-vcmp-guest--host/280685 BIG-IP Upgrade Procedure Using CLI (vCMP Guest & Host)]<br />
[[category:f5]]</div>
Nighthawk
http://www.cpwiki.net/index.php/snmp
snmp
2024-07-08T20:56:55Z
<p>Nighthawk: </p>
<hr />
<div>mib files location on check point device<br />
$CPDIR/lib/snmp/<br />
<br />
==mib descriptions and OID of interest==<br />
<br />
<br />
<br />
appliance model<br />
"svnApplianceProductName" "1.3.6.1.4.1.2620.1.6.16.7"<br />
<br />
get check point version<br />
"svnVersion" "1.3.6.1.4.1.2620.1.6.4.1"<br />
<br />
example:<br />
[Expert@chkpfw1:0]# '''snmpget -v2c -c public localhost 1.3.6.1.4.1.2620.1.6.4.1.0'''<br />
SNMPv2-SMI::enterprises.2620.1.6.4.1.0 = STRING: "R80.20"<br />
<br />
firewall connections<br />
$ '''snmptranslate -Tz -m CHECKPOINT-MIB | grep -i fwnumconn'''<br />
"fwNumConn" "1.3.6.1.4.1.2620.1.1.25.3"<br />
<br />
$ '''snmpget -v 2c -c public 10.0.0.254 1.3.6.1.4.1.2620.1.1.25.3.0'''<br />
SNMPv2-SMI::enterprises.2620.1.1.25.3.0 = Gauge32: 3310<br />
<br />
<br />
[[category:snmp]]<br />
[[category:monitoring]]</div>
Nighthawk
http://www.cpwiki.net/index.php/snmp
snmp
2024-07-08T20:53:59Z
<p>Nighthawk: </p>
<hr />
<div>mib files location on check point device<br />
$CPDIR/lib/snmp/<br />
<br />
==mib descriptions and OID of interest==<br />
<br />
<br />
<br />
appliance model<br />
"svnApplianceProductName" "1.3.6.1.4.1.2620.1.6.16.7"<br />
<br />
get check point version<br />
"svnVersion" "1.3.6.1.4.1.2620.1.6.4.1"<br />
<br />
example:<br />
[Expert@chkpfw1:0]# '''snmpget -v2c -c public localhost 1.3.6.1.4.1.2620.1.6.4.1.0'''<br />
SNMPv2-SMI::enterprises.2620.1.6.4.1.0 = STRING: "R80.20"<br />
<br />
firewall connections<br />
$ '''snmptranslate -Tz -m CHECKPOINT-MIB | grep -i fwnumconn'''<br />
"fwNumConn" "1.3.6.1.4.1.2620.1.1.25.3"<br />
<br />
$ '''snmpget -v 2c -c public 10.0.0.254 1.3.6.1.4.1.2620.1.1.25.3.0'''<br />
SNMPv2-SMI::enterprises.2620.1.1.25.3.0 = Gauge32: 3310<br />
<br />
<br />
[[category:snmp]]<br />
[[category:monitoring]]</div>
Nighthawk
http://www.cpwiki.net/index.php/vsx_notes
vsx notes
2024-07-03T14:25:54Z
<p>Nighthawk: </p>
<hr />
<div><br />
==performance optimization==<br />
concurrent connections sizing - automatic setting not available for VSX. this must be hard coded and monitored.<br />
==troubleshooting==<br />
<br />
show status<br />
[Expert@MyVsxGW:2]# '''vsx stat -v'''<br />
VSX Gateway Status<br />
==================<br />
Name:<br />
VSX1_192.168.3.241<br />
Access Control Policy: VSX_Cluster_VSX<br />
Installed at:<br />
20Sep2019 22:06:33<br />
Threat Prevention Policy: <No Policy><br />
SIC Status:<br />
Trust<br />
Number of Virtual Systems allowed by license:<br />
25<br />
Virtual Systems [active / configured]:<br />
2 / 2<br />
Virtual Routers and Switches [active / configured]:<br />
0 / 0<br />
Total connections [current / limit]:<br />
5 / 44700<br />
Virtual Devices Status<br />
======================<br />
ID | Type & Name | Access Control Policy | Installed at | Threat Prevention Policy | SIC Stat<br />
-----+-------------+-----------------------+-----------------+--------------------------+---------<br />
1 | S VS1 | VS_Policy | 20Sep2019 22:07 | <No Policy> | Trust<br />
2 | S VS2 | VS_Policy | 20Sep2019 22:07 | <No Policy> | Trust<br />
<br />
set the context to the appropriate Virtual System with "vsenv <ID|name><br />
# '''vsenv 2'''<br />
<br />
get interfaces<br />
# '''fw getifs'''</div>
Nighthawk
http://www.cpwiki.net/index.php/vsx_notes
vsx notes
2024-07-03T03:57:42Z
<p>Nighthawk: </p>
<hr />
<div><br />
<br />
==troubleshooting==<br />
<br />
show status<br />
[Expert@MyVsxGW:2]# '''vsx stat -v'''<br />
VSX Gateway Status<br />
==================<br />
Name:<br />
VSX1_192.168.3.241<br />
Access Control Policy: VSX_Cluster_VSX<br />
Installed at:<br />
20Sep2019 22:06:33<br />
Threat Prevention Policy: <No Policy><br />
SIC Status:<br />
Trust<br />
Number of Virtual Systems allowed by license:<br />
25<br />
Virtual Systems [active / configured]:<br />
2 / 2<br />
Virtual Routers and Switches [active / configured]:<br />
0 / 0<br />
Total connections [current / limit]:<br />
5 / 44700<br />
Virtual Devices Status<br />
======================<br />
ID | Type & Name | Access Control Policy | Installed at | Threat Prevention Policy | SIC Stat<br />
-----+-------------+-----------------------+-----------------+--------------------------+---------<br />
1 | S VS1 | VS_Policy | 20Sep2019 22:07 | <No Policy> | Trust<br />
2 | S VS2 | VS_Policy | 20Sep2019 22:07 | <No Policy> | Trust<br />
<br />
set the context to the appropriate Virtual System with "vsenv <ID|name><br />
# '''vsenv 2'''<br />
<br />
get interfaces<br />
# '''fw getifs'''</div>
Nighthawk
http://www.cpwiki.net/index.php/vsx_notes
vsx notes
2024-07-03T03:50:29Z
<p>Nighthawk: Created page with " ==troubleshooting== show status [Expert@MyVsxGW:2]# '''vsx stat -v''' VSX Gateway Status ================== Name: VSX1_192.168.3.241 Access Control Policy: VSX_Clust..."</p>
<hr />
<div><br />
<br />
==troubleshooting==<br />
<br />
show status<br />
[Expert@MyVsxGW:2]# '''vsx stat -v'''<br />
VSX Gateway Status<br />
==================<br />
Name:<br />
VSX1_192.168.3.241<br />
Access Control Policy: VSX_Cluster_VSX<br />
Installed at:<br />
20Sep2019 22:06:33<br />
Threat Prevention Policy: <No Policy><br />
SIC Status:<br />
Trust<br />
Number of Virtual Systems allowed by license:<br />
25<br />
Virtual Systems [active / configured]:<br />
2 / 2<br />
Virtual Routers and Switches [active / configured]:<br />
0 / 0<br />
Total connections [current / limit]:<br />
5 / 44700<br />
Virtual Devices Status<br />
======================<br />
ID | Type & Name | Access Control Policy | Installed at<br />
| Threat Prevention Policy | SIC Stat<br />
-----+-------------+-----------------------+-----------------+--------------------------+---------<br />
1 | S VS1 | VS_Policy | 20Sep2019 22:07 | <No Policy> | Trust<br />
2 | S VS2 | VS_Policy | 20Sep2019 22:07 | <No Policy> | Trust</div>
Nighthawk
http://www.cpwiki.net/index.php/cisco_asa_notes
cisco asa notes
2024-06-24T18:54:53Z
<p>Nighthawk: </p>
<hr />
<div>==Getting Started==<br />
===Accessing the Appliance Command-Line Interface===<br />
<br />
This following prompt indicates that you are in user EXEC mode. Only basic commands are available from user EXEC mode.<br />
hostname><br />
<br />
To access privileged EXEC mode, enter the following command:<br />
hostname> '''enable'''<br />
<br />
The prompt changes to the following:<br />
hostname#<br />
<br />
To exit privileged mode, enter the disable, exit, or quit command.<br />
<br />
access global configuration mode<br />
hostname# '''configure terminal'''<br />
<br />
The prompt changes to the following:<br />
hostname(config)#<br />
<br />
===configure base system===<br />
<br />
set firewall mode to transparent or routed? (Optional)<br />
<br />
example config... can paste on command line over console<br />
ASA Version 9.18.4<br />
!<br />
console serial<br />
interface management0/0<br />
nameif management<br />
security-level 100<br />
ip address 192.168.100.254 255.255.255.0<br />
no shutdown<br />
interface gigabitethernet0/0<br />
nameif inside<br />
security-level 100<br />
ip address 10.100.0.254 255.255.255.0<br />
no shutdown<br />
interface gigabitethernet0/1<br />
nameif outside<br />
security-level 0<br />
ip address 172.16.100.254 255.255.255.0<br />
no shutdown<br />
http server enable<br />
http 192.168.100.0 255.255.255.0 management<br />
crypto key generate rsa modulus 1024<br />
username admin password admin<br />
ssh 192.168.100.0 255.255.255.0 management<br />
aaa authentication ssh console LOCAL <br />
<br />
save config<br />
hostname(config)# '''write memory'''<br />
<br />
==VM notes==<br />
<br />
KVM graphical console stops after...<br />
Booting the kernel.<br />
<br />
at this point he VM is outputing to the virtual serial console. There are similar experiences on VMware.</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_downloads
fortinet downloads
2024-06-20T21:18:53Z
<p>Nighthawk: Created page with "https://support.fortinet.com/Download/FirmwareImages.aspx"</p>
<hr />
<div>https://support.fortinet.com/Download/FirmwareImages.aspx</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2024-06-20T18:10:14Z
<p>Nighthawk: </p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
===configure===<br />
example<br />
# config system interface<br />
# edit port1<br />
# set mode static<br />
# set ip 10.1.1.1 255.255.255.0<br />
# next<br />
# end<br />
<br />
===get info==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
or just leave the line out.<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
==default login==<br />
<br />
VM images = admin / (empty password)<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortimanager_VM_notes
fortimanager VM notes
2024-06-20T18:05:10Z
<p>Nighthawk: Created page with "==version 6.4== this version was used because higher versions were failing on the trial license for me. ==console login== default login = admin / (empty password) ==initial c..."</p>
<hr />
<div>==version 6.4==<br />
this version was used because higher versions were failing on the trial license for me.<br />
==console login==<br />
default login = admin / (empty password)<br />
<br />
==initial config==<br />
<br />
config system interface<br />
edit port1<br />
set mode static<br />
set ip 10.1.1.100 255.255.255.0<br />
next<br />
end<br />
config system route<br />
edit 1<br />
set device port1<br />
set gateway 10.1.1.1<br />
next<br />
end<br />
<br />
==license==<br />
<br />
connect a browser via https to the IP above. You get a message about signing into forticloud for the trial license. Login and proceed and hope for a message of success. I forgot to screenshot it.<br />
<br />
view VM license via CLI.<br />
<br />
FMG-VM64-KVM # '''diag debug vminfo'''<br />
VM license is valid.<br />
Type: Trial<br />
Max devices: 3<br />
Management IP: 0.0.0.0<br />
VM UUID: 2da3fe28-143d-415f-9939-2d8f8c6ce433<br />
<br />
no expiration date... yay! too bad it is so old.<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2024-06-20T17:59:13Z
<p>Nighthawk: </p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
==virtual machine==<br />
<br />
default login = admin / (empty password)<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/SRX_notes
SRX notes
2024-06-20T14:28:52Z
<p>Nighthawk: </p>
<hr />
<div>junos SRX notes<br />
<br />
show interface IPs<br />
> show interfaces terse | match inet<br />
<br />
show rule / policy<br />
# show security policies from-zone trust to-zone untrust policy <policy_name><br />
<br />
search address book for pre-defined objects<br />
# show security zones security-zone untrust address-book | match "192.168.1.1"<br />
<br />
<br />
monitoring traffic example<br />
monitor traffic matching "host 10.0.0.1" no-resolve interface reth0<br />
<br />
show cluster status <br />
root@SRXfw> '''show chassis cluster status''' <br />
Cluster ID: 1 <br />
Node Priority Status Preempt Manual failover<br />
Redundancy group: 0 , Failover count: 0<br />
node0 200 primary no no <br />
node1 100 secondary no no <br />
Redundancy group: 1 , Failover count: 3<br />
node0 200 secondary no no <br />
node1 100 primary no no<br />
<br />
add proxy arp<br />
set security nat proxy-arp interface reth0 address 192.168.1.1<br />
<br />
start unix shell<br />
> start shell user root <br />
<br />
example new rule (in progress)<br />
<br />
match > permit > insert<br />
<br />
==VM download==<br />
<br />
[https://webdownload.juniper.net/swdl/dl/secure/site/1/record/117212.html?pf=vSRX%20EVAL https://webdownload.juniper.net/swdl/dl/secure/site/1/record/117212.html?pf=vSRX%20EVAL]<br />
<br />
[[category:juniper]]</div>
Nighthawk
http://www.cpwiki.net/index.php/cisco_asa_notes
cisco asa notes
2024-06-20T04:41:25Z
<p>Nighthawk: </p>
<hr />
<div>==Getting Started==<br />
===Accessing the Appliance Command-Line Interface===<br />
<br />
This following prompt indicates that you are in user EXEC mode. Only basic commands are available from user EXEC mode.<br />
hostname><br />
<br />
To access privileged EXEC mode, enter the following command:<br />
hostname> '''enable'''<br />
<br />
The prompt changes to the following:<br />
hostname#<br />
<br />
To exit privileged mode, enter the disable, exit, or quit command.<br />
<br />
access global configuration mode<br />
hostname# '''configure terminal'''<br />
<br />
The prompt changes to the following:<br />
hostname(config)#<br />
<br />
===configure base system===<br />
<br />
set firewall mode to transparent or routed? (Optional)<br />
<br />
example config... can paste on command line over console<br />
ASA Version 9.18.4<br />
!<br />
console serial<br />
interface management0/0<br />
nameif management<br />
security-level 100<br />
ip address 192.168.100.254 255.255.255.0<br />
no shutdown<br />
interface gigabitethernet0/0<br />
nameif inside<br />
security-level 100<br />
ip address 10.100.0.254 255.255.255.0<br />
no shutdown<br />
interface gigabitethernet0/1<br />
nameif outside<br />
security-level 0<br />
ip address 172.16.100.254 255.255.255.0<br />
no shutdown<br />
http server enable<br />
http 192.168.100.0 255.255.255.0 management<br />
crypto key generate rsa modulus 1024<br />
username admin password admin<br />
ssh 192.168.100.0 255.255.255.0 management<br />
aaa authentication ssh console LOCAL <br />
<br />
save config<br />
hostname(config)# '''write memory'''</div>
Nighthawk
http://www.cpwiki.net/index.php/cisco_asa_notes
cisco asa notes
2024-06-20T03:16:13Z
<p>Nighthawk: Created page with "==Getting Started== Accessing the Appliance Command-Line Interface This following prompt indicates that you are in user EXEC mode. Only basic commands are available from user..."</p>
<hr />
<div>==Getting Started==<br />
Accessing the Appliance Command-Line Interface<br />
<br />
This following prompt indicates that you are in user EXEC mode. Only basic commands are available from user EXEC mode.<br />
hostname><br />
<br />
To access privileged EXEC mode, enter the following command:<br />
hostname> '''enable'''<br />
<br />
The prompt changes to the following:<br />
hostname#<br />
<br />
To exit privileged mode, enter the disable, exit, or quit command.<br />
<br />
access global configuration mode<br />
hostname# '''configure terminal'''<br />
<br />
The prompt changes to the following:<br />
hostname(config)#</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-06-09T07:05:30Z
<p>Nighthawk: </p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
===access rules===<br />
====notes before you begin====<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====show access layers?====<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
====examples====<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
====adding rules====<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
===log queries===<br />
mgmt_cli -s id.txt show-logs new-query.filter "src:10.0.0.11 and service:https" new-query.time-frame last-hour new-query.max-logs-per-request 1 --format json | jq '.logs[] | {time: .time,fw: .orig,log_server: .orig_log_server,policy: .policy_name,action: .action,source: .src,dest: .dst,service: .service}'<br />
<br />
{<br />
"time": "2023-06-09T06:20:20Z",<br />
"fw": "my_cp_fw1",<br />
"log_server": "192.168.1.88",<br />
"policy": "super_secure",<br />
"action": "Accept",<br />
"source": "10.0.0.11",<br />
"dest": "204.79.197.203",<br />
"service": "443"<br />
}<br />
<br />
==jq==<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
get values without keys<br />
<br />
example<br />
<br />
with keys...<br />
'''| jq '.objects[] | {name: .name,type: .type}''''<br />
{<br />
"name": chkp-fw",<br />
"type": "simple-gateway"<br />
}<br />
{<br />
"name": "chkp-mgmt",<br />
"type": "checkpoint-host"<br />
}<br />
<br />
without keys, change from curly {} to square [] brackets and drop key references<br />
'''| jq '.objects[] | [.name, .type]''''<br />
[<br />
"chkp-fw",<br />
"simple-gateway"<br />
]<br />
[<br />
"chkp-mgmt",<br />
"checkpoint-host"<br />
]<br />
<br />
print all values on the same line, comma separated<br />
'''| jq '.objects[] | [.name, .type] | join (",")'''<br />
"chkp-fw simple-gateway"<br />
"chkp-mgmt,checkpoint-host"<br />
<br />
==curl==<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://192.168.1.10:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-06-09T07:04:51Z
<p>Nighthawk: </p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
===access rules===<br />
====notes before you begin====<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====show access layers?====<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
====examples====<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
====adding rules====<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
===log queries===<br />
mgmt_cli -s id.txt show-logs new-query.filter "src:10.0.0.11 and service:https" new-query.time-frame last-hour new-query.max-logs-per-request 1 --format json | jq '.logs[] | {time: .time,fw: .orig,log_server: .orig_log_server,policy: .policy_name,action: .action,source: .src,dest: .dst,service: .service}'<br />
<br />
{<br />
"time": "2023-06-09T06:20:20Z",<br />
"fw": "my_cp_fw1",<br />
"log_server": "192.168.1.88",<br />
"policy": "super_secure",<br />
"action": "Accept",<br />
"source": "10.0.0.11",<br />
"dest": "204.79.197.203",<br />
"service": "443"<br />
}<br />
<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
get values without keys<br />
<br />
example<br />
<br />
with keys...<br />
'''| jq '.objects[] | {name: .name,type: .type}''''<br />
{<br />
"name": chkp-fw",<br />
"type": "simple-gateway"<br />
}<br />
{<br />
"name": "chkp-mgmt",<br />
"type": "checkpoint-host"<br />
}<br />
<br />
without keys, change from curly {} to square [] brackets and drop key references<br />
'''| jq '.objects[] | [.name, .type]''''<br />
[<br />
"chkp-fw",<br />
"simple-gateway"<br />
]<br />
[<br />
"chkp-mgmt",<br />
"checkpoint-host"<br />
]<br />
<br />
print all values on the same line, comma separated<br />
'''| jq '.objects[] | [.name, .type] | join (",")'''<br />
"chkp-fw simple-gateway"<br />
"chkp-mgmt,checkpoint-host"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://192.168.1.10:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/maestro_reference
maestro reference
2024-05-13T16:39:23Z
<p>Nighthawk: </p>
<hr />
<div>==security groups==<br />
Single Management Object (SMO) handles all management tasks, such as Security Gateway configuration, policy installation, remote connections, and logging. The Active Security Group Member with the lowest ID number is automatically assigned to be the SMO.<br />
<br />
identify the SMO and tasks<br />
# asg stat -i tasks<br />
<br />
===policy installation===<br />
Management ServerClosed installs the policy on the SMO Master and then it is copied to the other UP members. Use [[asg policy - command|asg policy]] to verify or unload a policy.<br />
===Synchronizing Policy and Configuration Between Security Group Members===<br />
<br />
synchronize the policies manually to a SG member<br />
asg_blade_config pull_config<br />
<br />
==Managing Security Groups==<br />
===Connecting to a Specific Security Group Member ===<br />
# member <Member ID><br />
or<br />
# m <Member ID><br />
<br />
connecting to member in specific SG<br />
# m <Security Group ID> <Member ID><br />
<br />
<br />
==HA==<br />
clusterXL_admin up<br />
<br />
<br />
==orchestrator==<br />
<br />
get port transiever typoe<br />
> show maestro port x optic info</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2024-05-07T19:47:12Z
<p>Nighthawk: </p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
==misc==<br />
<br />
check if fortigate has fortimanager central-management setting<br />
$ show full-configuration | grep "set fmg "<br />
<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/fortinet_CLI_notes
fortinet CLI notes
2024-05-02T23:14:15Z
<p>Nighthawk: /* packet capture */</p>
<hr />
<div><br />
<br />
==vdom==<br />
entering editing a vdom<br />
<br />
# config vdom<br />
(vdom) # edit myvdom<br />
(myvdom) # <br />
<br />
==interface commands==<br />
for admin status, link stat, speeds, counters...<br />
# config global<br />
# get hardware nic <interface name><br />
<br />
==routes==<br />
# config router static<br />
# edit <route_index><br />
# set device "<interface_name>"<br />
# set dst "<destination_ip>"<br />
# set gateway "<router_ip>"<br />
<br />
for default gw..<br />
# set dst 0.0.0.0 0.0.0.0<br />
<br />
HA status<br />
# config global<br />
# get sys ha status<br />
<br />
HA failover to highest priority (if it is not currently Master)<br />
on current master run...<br />
# config global<br />
# diagnose sys ha reset-uptime<br />
<br />
get admin hash password<br />
# config global<br />
# config sys admin<br />
# show<br />
<br />
uptime<br />
# config global<br />
# get system perf status | grep -i uptime<br />
<br />
shutdown/reboot<br />
<br />
# execute shutdown<br />
or<br />
# execute reboot<br />
<br />
==firewall==<br />
# show firewall policy<br />
<br />
==packet capture==<br />
<br />
# diagnose sniffer packet <interface|any> '<tcpdump-filter>' <verbosity> <count> <time-format><br />
<br />
where if count = 0, then unlimited<br />
<br />
example:<br />
fotinet1 # '''diagnose sniffer packet port1 'icmp'''' 4 2 l<br />
interfaces=[port1]<br />
filters=[icmp]<br />
2022-08-25 13:16:52.397609 port1 -- 192.168.169.76 -> 192.168.169.31: icmp: echo request<br />
2022-08-25 13:16:52.397673 port1 -- 192.168.169.31 -> 192.168.169.76: icmp: echo reply<br />
<br />
<br />
<br />
[[category:fortinet]]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-05-02T04:18:22Z
<p>Nighthawk: /* jq */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
get values without keys<br />
<br />
example<br />
<br />
with keys...<br />
'''| jq '.objects[] | {name: .name,type: .type}''''<br />
{<br />
"name": chkp-fw",<br />
"type": "simple-gateway"<br />
}<br />
{<br />
"name": "chkp-mgmt",<br />
"type": "checkpoint-host"<br />
}<br />
<br />
without keys, change from curly {} to square [] brackets and drop key references<br />
'''| jq '.objects[] | [.name, .type]''''<br />
[<br />
"chkp-fw",<br />
"simple-gateway"<br />
]<br />
[<br />
"chkp-mgmt",<br />
"checkpoint-host"<br />
]<br />
<br />
print all values on the same line, comma separated<br />
'''| jq '.objects[] | [.name, .type] | join (",")'''<br />
"chkp-fw simple-gateway"<br />
"chkp-mgmt,checkpoint-host"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://192.168.1.10:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-05-02T04:18:00Z
<p>Nighthawk: /* jq */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
get values without keys<br />
<br />
example<br />
<br />
with keys...<br />
'''| jq '.objects[] | {name: .name,type: .type}''''<br />
{<br />
"name": chkp-fw",<br />
"type": "simple-gateway"<br />
}<br />
{<br />
"name": "chkp-mgmt",<br />
"type": "checkpoint-host"<br />
}<br />
<br />
without keys, change from curly {} to square [] brackets and drop key references<br />
'''| jq '.objects[] | [.name, .type]''''<br />
[<br />
"chkp-fw",<br />
"simple-gateway"<br />
]<br />
[<br />
"chkp-mgmt",<br />
"checkpoint-host"<br />
]<br />
<br />
print all values on the same line, comma separated<br />
'''| jq '.objects[] | [.name, .type] | join (",")'''<br />
"chkp-fw simple-gateway"<br />
"chkp-mgmt,checkpoint-host"<br />
<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://192.168.1.10:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-05-02T04:17:39Z
<p>Nighthawk: /* jq */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
get values without keys<br />
<br />
example<br />
<br />
with keys...<br />
'''| jq '.objects[] | {name: .name,type: .type}''''<br />
{<br />
"name": chkp-fw",<br />
"type": "simple-gateway"<br />
}<br />
{<br />
"name": "chkp-mgmt",<br />
"type": "checkpoint-host"<br />
}<br />
<br />
without keys, change from curly {} to square [] brackets and drop key references<br />
| jq '.objects[] | [.name, .type]'<br />
[<br />
"chkp-fw",<br />
"simple-gateway"<br />
]<br />
[<br />
"chkp-mgmt",<br />
"checkpoint-host"<br />
]<br />
<br />
print all values on the same line, comma separated<br />
| jq '.objects[] | [.name, .type] | join (",")<br />
"chkp-fw simple-gateway"<br />
"chkp-mgmt,checkpoint-host"<br />
<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://192.168.1.10:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-05-02T04:17:11Z
<p>Nighthawk: /* jq */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
get values without keys<br />
<br />
example<br />
<br />
with keys...<br />
| jq '.objects[] | {name: .name,type: .type}'<br />
{<br />
"name": chkp-fw",<br />
"type": "simple-gateway"<br />
}<br />
{<br />
"name": "chkp-mgmt",<br />
"type": "checkpoint-host"<br />
}<br />
<br />
without keys, change from curly {} to square [] brackets and drop key references<br />
| jq '.objects[] | [.name, .type]'<br />
[<br />
"chkp-fw",<br />
"simple-gateway"<br />
]<br />
[<br />
"chkp-mgmt",<br />
"checkpoint-host"<br />
]<br />
<br />
print all values on the same line, comma separated<br />
| jq '.objects[] | [.name, .type] | join (",")<br />
"chkp-fw simple-gateway"<br />
"chkp-mgmt,checkpoint-host"<br />
<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://192.168.1.10:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-05-02T04:07:15Z
<p>Nighthawk: /* jq */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
get values without keys<br />
<br />
example<br />
<br />
with keys...<br />
| jq '.objects[] | {name: .name,type: .type}'<br />
without keys, change from curly {} to square [] brackets and drop key references<br />
| jq '.objects[] | [.name, .type]'<br />
<br />
print all values on the same line, comma separated<br />
| jq '.objects[] | [.name, .type] | join (",")<br />
<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://192.168.1.10:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-04-01T19:25:28Z
<p>Nighthawk: /* curl */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://192.168.1.10:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-03-19T16:24:06Z
<p>Nighthawk: /* curl */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://10.128.1.81:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-03-19T16:23:09Z
<p>Nighthawk: /* curl */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://10.128.1.81:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -H "X-chkp-sid: $SESSIONID" -d '{ }' https://192.168.1.10:443/web_api/keepalive'''<br />
{<br />
"message" : "OK"<br />
}<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-03-19T16:15:28Z
<p>Nighthawk: /* curl */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://10.128.1.81:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
lol<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-03-19T16:14:52Z
<p>Nighthawk: /* curl */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$ '''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://10.128.1.81:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-03-19T16:14:44Z
<p>Nighthawk: /* curl */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$'''curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login'''<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://10.128.1.81:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-03-19T16:14:22Z
<p>Nighthawk: /* curl */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
$== curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login ==<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://10.128.1.81:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-03-19T16:13:45Z
<p>Nighthawk: /* curl */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" -d '{"userId": 5, "title": "Post Title", "body": "Post content."}' <br />
<br />
curl -X -H POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' 192.168.1.10:443/login<br />
<br />
curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://10.128.1.81:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-02-16T16:38:52Z
<p>Nighthawk: /* jq examples */</p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==examples==<br />
===jq===<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
===curl===<br />
<br />
curl -X POST -H "Content-Type: application/json" \<br />
-d '{"userId": 5, "title": "Post Title", "body": "Post content."}' \<br />
https://jsonplaceholder.typicode.com/posts<br />
<br />
<br />
curl -X -H POST -H "Content-Type: application/json" \<br />
-d '{"user" : "jsmith", "password" : "abc123"}' \<br />
192.168.1.10:443/login<br />
<br />
curl --insecure -X POST -H "Content-Type: application/json" -d '{"user" : "jsmith", "password" : "abc123"}' https://192.168.1.10:443/web_api/login<br />
{<br />
"uid" : "46a11170-e554-4e58-a5fc-65ff9e38d8cb",<br />
"sid" : "dfq6sI1MxMT1qUhXQ7tafQduKAfJxYkqXCEjaQKjres",<br />
"url" : "https://10.128.1.81:443/web_api",<br />
"session-timeout" : 600,<br />
"last-login-was-at" : {<br />
"posix" : 1707413218074,<br />
"iso-8601" : "2024-02-08T10:26-0700"<br />
},<br />
"api-server-version" : "1.8.1",<br />
"user-name" : "jsmith",<br />
"user-uid" : "c1109c35-d741-7jg8-98e3-36669b7047a2"<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk
http://www.cpwiki.net/index.php/r80_api_notes
r80 api notes
2024-02-16T16:22:45Z
<p>Nighthawk: </p>
<hr />
<div>==Management server API setup==<br />
===enabling for remote IPs===<br />
done the smartconsole<br />
<br />
[[file:cp_mgmt_api_enable_all_IPs.png]]<br />
<br />
it can also be enabled via mgmt_cli under "set api-settings"<br />
<br />
===status check===<br />
<br />
[Expert@chmkmgr1:0]# '''api status'''<br />
<br>API Settings: <br />
<br><nowiki>-----------------</nowiki><br />
<br>Accessibility: Require all granted <br />
<br>Automatic Start: Enabled <br />
<br>Processes: <br />
<br>Name State PID More Information<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API Started 10763 <br />
<br>CPM Started 10460 Check Point Security Management Server is running and ready<br />
<br>FWM Started 10007 <br />
<br>Port Details: <br />
<br><nowiki>----------------</nowiki><br />
<br>JETTY Internal Port: 50276 <br />
<br>APACHE Gaia Port: 443 <br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>Overall API Status: Started<br />
<br><nowiki>-------------------------------------------------</nowiki><br />
<br>API readiness test SUCCESSFUL. The server is up and ready to receive connections<br />
<br />
==examples==<br />
===logging in===<br />
login and redirect session info to a file for reuse<br />
# mgmt_cli login user admin > id.txt<br />
<br />
same but read only<br />
# mgmt_cli login user admin read-only true > id.txt<br />
<br />
===search existing object===<br />
search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'<br />
<br />
return only objects with the EXACT ip<br />
<br />
# mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true details-level full --format json | jq '.objects[] | select(."ipv4-address" == "192.168.1.1") | .name'<br />
<br />
*** details-level full will include more objects, including other stuff like type CpmiHostCkp (built in smartcenter object)<br />
<br />
==access rules==<br />
===notes before you begin===<br />
when using the parameter "name" to refer to a particular package, it appears to require the following...<br />
<package name> <layer name><br />
<br />
as shown by the show access-layers command below. Also, the output of show access-rulebase doesn't is limited to 50 rules. If you want more, I think you have to iterate though a set of offets until all the rules are dumped. That dump in json format is a bit confusing. If you have no "headers" or "titles" in the ruleset, you will get 1 rulebase[] array. If you have headers, each section is its own rulebase[] array with yet another rulebase[] array containing the actual rules.<br />
<br />
What this means is the commands below may or may not work as you expect them to. The will likely need to be altered with mgmt_cli "offset" commands and/or modified jq commands... <br />
<br />
for example, if you have NO headers in your policy and are running show access-rulebase, it will output the rules with <br />
<br />
| jq '.rulebase[]'<br />
<br />
if you DO HAVE headers, to output the rules you need<br />
<br />
| jq '.rulebase[] | .rulebase[]'<br />
<br />
====rule numbers====<br />
<br />
===show access layers?===<br />
[Expert@chmkmgr1:0]# '''mgmt_cli show access-layers -s id.txt --format json | jq '."access-layers"[].name'<br />
"dropall Network"'''<br />
"Network"<br />
<br />
where "Network" represents the default policy package Standard<br />
<br />
===examples===<br />
show number of rules in policy<br />
mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'<br />
<br />
display rule with uid = xxx<br />
<br />
# '''mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"'''<br />
<br />
display src/dst/service from rule with uid<br />
for i in source destination service; do echo $i; mgmt_cli -s id.txt show access-rule layer "<policy_name> <layer_name>" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx" --format json | jq .$i[].name; done<br />
<br />
alternate(inferior) way with jq<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.uid == "1de8fab0-4858-4067-977d-1cbb5cd2e55d") | ."rule-number"'<br />
1<br />
<br />
display rule number with comment containing a string haha<br />
mgmt_cli show access-rulebase name "Network" -s id.txt package "Standard" show-hits true --format json | jq '.rulebase[] | select (.comments | contains("haha")) | {rulenum: ."rule-number", comment: .comments}'<br />
<br />
===adding rules===<br />
<br />
mgmt_cli -s id.txt add access-rule layer xxad70c9-b4c6-4e64-9bfd-d57ac91289f3 name new_rule<br />
<br />
mgmt_cli -s id.txt add access-rule layer xx70adc9-b4c6-4e64-9bfd-d57ac91289f3 position top name new_rule<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" action "Accept" service add "https"<br />
<br />
mgmt_cli -s id.txt set access-rule name "new_rule" layer "xx70adc9-b4c6-4e64-9bfd-d57ac91289f3" service.add "https"<br />
<br />
<br />
===mds / domain===<br />
<br />
get list of domains,objects(management and firewalls),object type<br />
mgmt_cli.exe -s id.txt show gateways-and-servers --format json limit 500 | jq '.objects.nat,.name,.type' | xargs -n3<br />
<br />
==jq examples==<br />
<br />
compound jq select using and/or (note: contains returns true/false)<br />
<br />
| jq '.rulebase[] | .rulebase[] | select (.comments | (contains("hahaha") or contains("lol")) | not ) | {ruleUID: .uid, comments: .comments} '<br />
<br />
and another one...<br />
| jq '.rulebase[] | .rulebase[] | select ((.comments | (contains("hahah") or contains("lol") | not )) and (.enabled == true)) | {enabled: .enabled, rulenum: ."rule-number", ruleUID: .uid, comments: .comments} '<br />
<br />
filter objects dictary for uid for accept action<br />
jq '."objects-dictionary"[] | select (.name == "Accept") | .uid'<br />
<br />
get cluster member policy installation targets<br />
<br />
| jq -c '."installation-targets-revision"[] | ."cluster-members-revision"[] | ."target-name"' | tr -d '"' | tr '\n' ' '<br />
<br />
<br />
<br />
<br />
"rulenum": 1,<br />
<br> "comment": "hahahlol"<br />
<br />
==links==<br />
[https://community.checkpoint.com/t5/General-Management-Topics/What-s-new-with-R80-20M1-Management-API/td-p/39522 What's new with R80.20M1 Management API]<br />
<br />
[https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction~v1.4%20 r80 api reference]<br />
<br />
[https://github.com/CheckPointSW/cp_mgmt_api_python_sdk official python open source api]<br />
<br />
parsing json return output<br />
[https://stedolan.github.io/jq/ jq]<br />
<br />
[https://community.checkpoint.com/thread/1083 Parsing the output of mgmt_cli]<br />
<br />
[https://devqa.io/curl-sending-api-requests/ How to Use CURL to Send API Requests]</div>
Nighthawk