Check Point Extension

Connect a Check Point Security Management Server (or Multi-Domain Server) by saving its host and admin credentials, after exchanging them once for a session id.

List the connected Check Point Management Server(s).

Disconnect a Check Point Management Server: deletes the saved session credentials. Nothing on the server itself is changed.

List host objects defined on the connected Check Point Management Server.

Create a new host object on the connected Check Point Management Server. Changes are pending until publish_changes is called.

Update an existing host object's IP address. Changes are pending until publish_changes is called.

Permanently delete a host object by name. Changes are pending until publish_changes is called.

List network objects defined on the connected Check Point Management Server.

Create a new network object on the connected Check Point Management Server. Changes are pending until publish_changes is called.

Update an existing network object's subnet/mask. Changes are pending until publish_changes is called.

Permanently delete a network object by name. Changes are pending until publish_changes is called.

List group objects (named collections of hosts/networks) defined on the connected Check Point Management Server.

Create a new group object on the connected Check Point Management Server, optionally with initial members (by name). Changes are pending until publish_changes is called.

List TCP/UDP service (port) objects defined on the connected Check Point Management Server.

Create a new TCP or UDP service (port) object on the connected Check Point Management Server. Changes are pending until publish_changes is called.

Permanently delete a TCP or UDP service object by name. Changes are pending until publish_changes is called.

List access control policy layers configured on the connected Check Point Management Server.

List access control rules in one policy layer on the connected Check Point Management Server.

Read one access control rule in full by name.

Create a new access control rule in a policy layer. Changes are pending until publish_changes is called.

Update an existing access control rule's action and/or enabled status. Changes are pending until publish_changes is called.

Permanently delete an access control rule by name. Changes are pending until publish_changes is called.

Publish all pending changes in the current session so they become visible to other administrators/API sessions -- Check Point's mandatory staging step, same convention as a Fortinet/PAN-OS commit but scoped to the whole session, not one config unit.

Discard all pending (unpublished) changes in the current session, reverting to the last published state.

List policy packages defined on the connected Check Point Management Server.

Install a published policy package onto its target gateways/clusters -- an asynchronous operation; use get_task_status with the returned task_id to check progress.

Read the status of an asynchronous task (e.g. install_policy) by task id.

List gateway and cluster objects managed by the connected Check Point Management Server.

Enable or disable several Check Point access rules in one call, by explicit rule names. Continues past per-item failures and reports each outcome, same convention as every other bulk_* tool in the portfolio.

Run a read-only health audit across all connected Check Point Management Servers: overly broad access rules (any/any with allow), rules with no logging, and unpublished pending changes.