Skip to content

Adds VLAN-interfaces to CheckPoint firewalls and it's object on the Management-server, read from a supernet in phpIPAM.

License

Notifications You must be signed in to change notification settings

durd/cp-interface

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

13 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

cp-interfaces.py

Adds VLAN-interfaces to CheckPoint firewalls and it's object on the Management-server, read from a supernet in phpIPAM.

Caveats

  • This script has no error-checking except what is in the SDKs/APIs that I've used. It will add the wrong VLANs to the wrong gateway and policy!
  • Also a feature. It will add all the VLANs as rule sections even if only one VLAN was added. Easy enough to clean up, but annoying.
  • I didn't have a proper test environment when making this, once I used the script in production I didn't have time to fix things, so it's quick and dirty and ugly. I blame my python-skills.
  • Also, I've never tested this with a complete cluster of at least 2 nodes. It's always been single node clusters. Should work, but yeah.

Requisites

  • only adds NEW VLAN-interfaces
  • not tested if a VLAN is removed from IPAM
  • can not be used to "sync" a node to another node, please se cp-clone-interface instead
  • IP-addressing assumes that cluster-ip and both node-IPs are after eachother, ex: vip .1, node-1 .2, node-2 .3
  • cluster object IP needs to be reachable, ie create a vip for the cluster IP

Requirements

phpIPAM

  • >v1.4
  • access to the phpIPAM in question:
    • HTTP or HTTPS (self-signed works, generates a bunch of warnings)
    • A user for API
    • a group with read-permissions in the "Section" in question(, also permission to read certain VLANs??)
    • need an API application with read permission
    • "App security" should be "SSL with User token" - a user logs in and gets a new token at login. When building this script, HTTP worked even though SSL was selected.
  • data structure
    • the script reads from a parent subnet (supernet)
    • from the parent subnet the child subnets are read
    • the child subnets MUST have a VLAN-id (id in phpIPAM) that is NOT zero
    • child subnets VLAN and VLAN-number are read
    • unused subnets MUST have at least three x's in its description: subnet-description-xxx to not be added in the firewalls
    • the script assumes that within a section there aren't any VLAN's that contain several subnets
    • the script also assumes that a parent subnet does NOT contain a subnet that should belong to a different firewall. (
    • every subnet under a supernet that has a VLAN-id (not number) is added to the same firewall. Issues within your network could arrise

CheckPoint

  • API version >1.6.1 (R80.40 JHF 78 or newer)
  • access to both Management and the gateways/nodes in question
  • data structure
    • cluster object in question is read from the supplied policy package on commandline
    • existing VLANs are fetched from the active node (actually the cluster, but that is the active node)
    • the gateways VLANs are diffed against the VLANs from IPAM and a list is created with VLANs that are not on the gateway
    • a description for the interface on the gateway and in the cluster object is built from IPAM subnet description
    • Rule section names are created with the following convention: <vlan-id>-<subnet>_<mask>-<vlan-description>
    • VLAN is added to a parent interface (bond, physical etc), first on the active node and then the passive node. This so that the cluster doesn't fail unnecessarily.
    • the VLANs added to the gateway are added to the cluster object
    • Rule sections are added at the bottom of the policy package supplied on commandline
    • if any VLANs have been added to the cluster object, the changes are published/saved but not installed

The script

Install python3 dependencies with: pip3 install -r requirements.txt

Tested with Python3.9.5. Please create a virtualenv before installing dependencies.

Syntax

python3 ./cp-interfaces2.py -i <ipam url> -iu <user> -ip <password -ia <api_app> -csms <IP or hostname> -cu <user> -cp <password> -cnnr <#> <supernet> <policy name> <parent interface>

<-i>                URL to phpIPAM
<-iu>               username in phpIPAM
<-ip>               password for the above user
<-ia>               API-app in phpIPAM
<-csms>             IP or hostname CP Management in question
<-cu>               username in CheckPoint
<-cp>               password for the above user
<-cnnr>             Cluster Node Number, if you for some reason are setting up your secondary gateways first, put a 2 here - else 1.
<supernet>          supernet from phpIPAM
<policy name>       name of policy package which cluster/gateway belongs to as an 'Installation target'
<parent interface>  interface that will have the VLANs added to

Example:  
python3 ./cp-interfaces.py -i http://ipam.example.com -iu user -ip password -ia api_app -csms cp-mgmt -cu user -cp password -cnnr 1 10.10.10.16/28 Standard eth1

About

Adds VLAN-interfaces to CheckPoint firewalls and it's object on the Management-server, read from a supernet in phpIPAM.

Topics

Resources

License

Stars

Watchers

Forks

Languages