CP的mgmt_cli tool与SMC CLI用法

因客户版本升级未成功，所以考虑到手动添加策略和主机信息与NAT，所以研究了下准备把客户的防火墙信息写成脚本(ps:客户防火墙策略2000条起，所以才想的偷懒办法写脚本)

首先得说下关于CP的mgmt_cli命令的语法博客是在80.10的All in one里测试的
必须在 专家模式专家模式专家模式 上执行

login

使用用户名和密码登录到服务器。服务器显示您的会话唯一标识符。在每个请求的“X-chkp-sid”报头中输入此会话唯一标识符。

Syntax

mgmt_cli login

参数可以输入后填入

Command

mgmt_cli login

Output

Username: admin
Password:
uid: "b46805b4-09bc-4095-aaf3-9ba9a307f1eb"
sid: "wjPvhRNxNMD7le8QD1isO49Q6XFpAIRybVzIKj39v3k"
url: "https://127.0.0.1:443/web_api"
session-timeout: 600
last-login-was-at: posix: 1577413337633iso-8601: "2019-12-27T10:22+0800"
api-server-version: "1.1"

也可以直接输入登陆

Conmand

mgmt_cli login user "aa" password "aaaa"

Output

uid: "995fa260-7621-44cb-ab2f-cb383558c1ad"
sid: "WHc1fh8KqepdggnVe3gNe-xGrW8lFjWbkAczRTLDx1E"
url: "https://127.0.0.1:443/web_api"
session-timeout: 600
last-login-was-at: posix: 1577413718049iso-8601: "2019-12-27T10:28+0800"
api-server-version: "1.1"

public

只有在调用publish之后，所有用户才能看到该用户所做的所有更改。

Syntax

mgmt_cli public

Conmand

mgmt_cli publish

Output(tasks查看进度)

---------------------------------------------
Time: [11:07:52] 27/12/2019
---------------------------------------------
"Publish operation"  succeeded  (100%)
tasks:
- task-id: "01234567-89ab-cdef-8dbc-0b2a427c153c"task-name: "Publish operation"status: "succeeded"progress-percentage: 100suppressed: falsetask-details: - publishResponse: numberOfPublishedChanges: 0revision: "95574349-e66c-461a-bcfe-d6f4524720a0"

discard

用户所做的所有更改都将被丢弃并从数据库中删除。

Syntax

mgmt_cli discard

Conmand

mgmt_cli discard

Output

{number-of-discarded-changes: 0message: "OK"
}

keepalive

保持会话有效/活动。

Syntax

mgmt_cli keepalive

Conmand

mgmt_cli keepalive

Output

{"message" : "OK"
}

add host

添加主机

Syntax

mgmt_cli add host

Arguments

Conmand

mgmt_cli add host name "New Host 1" ip-address "192.0.2.1"

Output

{"uid" : "9423d36f-2d66-4754-b9e2-e7f4493756d4","folder" : {"uid" : "feb54da1-c5e2-4e83-a3ed-d0601ba5ccb9","name" : "/Global Objects"},"domain" : {"domain-type" : "local domain","uid" : "41e821a0-3720-11e3-aa6e-0800200c9fde","name" : "SMC User"},"meta-info" : {"lock" : "unlocked","validation-state" : "ok","read-only" : false,"last-modify-time" : {"posix" : 1429440561055,"iso-8601" : "2015-04-19T13:49+0300"},"last-modifier" : "aa","creation-time" : {"posix" : 1429440561055,"iso-8601" : "2015-04-19T13:49+0300"},"creator" : "aa"},"tags" : [ ],"name" : "New Host 4","comments" : "","color" : "black","icon" : "Objects/host","groups" : [ ],"nat-settings" : {"auto-rule" : false},"ipv4-address" : "192.0.2.1","ipv6-address" : ""
}

add network

创建新对象

Syntax

mgmt_cli add network

Conmand

mgmt_cli add network name "New Network 1" subnet "192.0.2.0" subnet-mask "255.255.255.0"

Output

{"message" : "OK"
}

add access-rule

创建新策略

Syntax

mgmt_cli add access-rule

Conmand

mgmt_cli add access-rule layer "Network" position 1 name "Rule 1" service.1 "SMTP" service.2 "AOL" vpn "MyIntranet"

Output

{"uid" : "1df8a4b0-fa8b-428b-b649-626b74bf7f81","name" : "Rule 1","type" : "access-rule","domain" : {"uid" : "41e821a0-3720-11e3-aa6e-0800200c9fde","name" : "SMC User","domain-type" : "domain"},"enabled" : true,"comments" : "","meta-info" : {"lock" : "locked by current session","validation-state" : "ok","last-modify-time" : {"posix" : 1482659046483,"iso-8601" : "2016-12-25T11:44+0200"},"last-modifier" : "aa","creation-time" : {"posix" : 1482659046483,"iso-8601" : "2016-12-25T11:44+0200"},"creator" : "aa"},"install-on" : [ {"uid" : "6c488338-8eec-4103-ad21-cd461ac2c476","name" : "Policy Targets","type" : "Global","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"}} ],"source" : [ {"uid" : "97aeb369-9aea-11d5-bd16-0090272ccb30","name" : "Any","type" : "CpmiAnyObject","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"}} ],"source-negate" : false,"destination" : [ {"uid" : "97aeb369-9aea-11d5-bd16-0090272ccb30","name" : "Any","type" : "CpmiAnyObject","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"}} ],"destination-negate" : false,"service" : [ {"uid" : "97aeb3d9-9aea-11d5-bd16-0090272ccb30","name" : "smtp","type" : "service-tcp","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"},"port" : "25"}, {"uid" : "97aeb44f-9aea-11d5-bd16-0090272ccb30","name" : "AOL","type" : "service-tcp","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"},"port" : "5190"} ],"service-negate" : false,"vpn" : [ {"uid" : "8fcd975f-33b1-4322-b033-6fb251554d45","name" : "MyIntranet","type" : "vpn-community-meshed","domain" : {"uid" : "41e821a0-3720-11e3-aa6e-0800200c9fde","name" : "SMC User","domain-type" : "domain"}} ],"action" : {"uid" : "6c488338-8eec-4103-ad21-cd461ac2c473","name" : "Drop","type" : "RulebaseAction","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"}},"action-settings" : {"enable-identity-captive-portal" : false},"content" : [ {"uid" : "97aeb369-9aea-11d5-bd16-0090272ccb30","name" : "Any","type" : "CpmiAnyObject","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"}} ],"content-negate" : false,"content-direction" : "any","track" : {"uid" : "29e53e3d-23bf-48fe-b6b1-d59bd88036f9","name" : "None","type" : "Track","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"}},"track-alert" : "none","time" : [ {"uid" : "97aeb369-9aea-11d5-bd16-0090272ccb30","name" : "Any","type" : "CpmiAnyObject","domain" : {"uid" : "a0bbbc99-adef-4ef8-bb6d-defdefdefdef","name" : "Check Point Data","domain-type" : "data domain"}} ],"custom-fields" : {"field-1" : "","field-2" : "","field-3" : ""}
}

查看API语法添加参数

其他的命令就没有去测试了差不多语法都是一样 CP只是在专家模式下执行的，不过执行的每一条都需要输入登陆的用户名和密码较为麻烦如果使用批处理推荐登陆SMC添加脚本文件然后上传执行

SMC CLI

位置是在登陆SMC后的左下角 COMMAND LINE

add host

创建主机

Syntax

add host

Conmand

add host name "New Host 1" ip-address "192.0.2.1"

Output

无返回结果就是成功了

add network

创建新对象

Syntax

add network

Conmand

 add network name "New Network 1" subnet "192.0.2.0" subnet-mask "255.255.255.0"

add access-rule

创建新策略

Syntax

 add access-rule

Conmand

add access-rule layer "Network" position 1 name "Rule 1" service.1 "SMTP" service.2 "AOL" vpn "MyIntranet"

Output

无返回结果就是成功了

以上就是CP在设备的命令行和SMC的命令行上如何敲命令进行操作，批处理推荐执行脚本 GAREWAYS&SERVERS ->中间Scripts可以写脚本然后执行语法与登陆设备的CLI命令相似

官网