Skip to content

Commit a545a52

Browse files
authored
Update README.md
1 parent 4641298 commit a545a52

File tree

1 file changed

+81
-2
lines changed

1 file changed

+81
-2
lines changed

README.md

Lines changed: 81 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,81 @@
1-
# CheckPointAnsibleMgmtCollection
2-
CheckPointAnsibleMgmtCollection
1+
# Check Point Ansible Mgmt Collection
2+
This Ansible collection provides control over a Check Point management server using
3+
Check Point's web-services APIs.
4+
5+
The Ansible Check Point moduules reference can be found here:
6+
https://docs.ansible.com/ansible/latest/modules/list_of_network_modules.html#check-point
7+
Note - look only at the `cp_mgmt_*` modules, cause the `checkpoint_*` will be depricated.
8+
9+
Installation instructions
10+
-------------------------
11+
Run `ansible-galaxy collection install check_point.mgmt`
12+
13+
Requirements
14+
------------
15+
* Ansible 2.9+ is required.
16+
* The Check Point server should be using the versions detailed in this SK: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114661
17+
* The Check Point server should be open for API communication from the ansible server.
18+
Open SmartConsole ans check "Manage & Settings > Blades > Management API > Advanced settings".
19+
20+
Usage
21+
-----
22+
1. Edit the `hosts` so that it would contain a section similar to this one:
23+
```
24+
[check_point]
25+
%YOUR_IP%
26+
[checkpoint:vars]
27+
ansible_httpapi_use_ssl=True
28+
ansible_httpapi_validate_certs=False
29+
ansible_user=%YOUR_USER%
30+
ansible_password=%YOUR_PASSWORD%
31+
ansible_network_os=check_point.mgmt.checkpoint
32+
```
33+
Note - If you want to run against Ansible version 2.9 instead of the collection, just replace `ansible_network_os=check_point.mgmt.checkpoint` with `ansible_network_os=checkpoint`
34+
2. Run a playbook:
35+
```sh
36+
ansible-playbook your_ansible_playbook.yml
37+
```
38+
or
39+
40+
Run a playbook in "check mode":
41+
```sh
42+
ansible-playbook -C your_ansible_playbook.yml
43+
```
44+
Example playbook:
45+
```
46+
---
47+
- name: playbook name
48+
hosts: checkpoint
49+
connection: httpapi
50+
tasks:
51+
- name: task to have network
52+
check_point.mgmt.cp_mgmt_network:
53+
name: "network name"
54+
subnet: "4.1.76.0"
55+
mask_length: 24
56+
auto_publish_session: true
57+
58+
vars:
59+
ansible_checkpoint_domain: "SMC User"
60+
```
61+
Note - If you want to run against Ansible version 2.9 instead of the collection, just replace `check_point.mgmt.cp_mgmt_network` with `cp_mgmt_network`
62+
63+
### Notes:
64+
1. Because this Ansible module is controlling the management server remotely via the web API,
65+
the ansible server needs to have access to the Check Point API server.
66+
Open `SmartConsole`, navigate to "Manage & Settings > Blades > Management API > Advanced settings"
67+
and check the API server's accessibility set
68+
2. Ansible has a feature called "Check Mode" that enables you to test the
69+
changes without actually changing anything.
70+
3. The login and logout happens automatically.
71+
4. If you want to login to specific domain, in the playbook above in the `vars`secion insert the domain name to
72+
`ansible_checkpoint_domain`
73+
5. There are two ways to publish changes:
74+
a. Set the `auto_publish_session` to `true` as displayed in the example playbook above.
75+
This option will publish only the task which this parameter belongs to.
76+
b. Add the task to publish with the `cp_mgmt_publish` module.
77+
This option will publish all the tasks above this task.
78+
6. It is recommended by Check Point to use this collection over the modules of Ansible version 2.9
79+
7. If you still want to use Ansible version 2.9 instead of this collection (not recommended):
80+
a. In the `hosts` file replace `ansible_network_os=check_point.mgmt.checkpoint` with `ansible_network_os=checkpoint`
81+
b. In the task in the playbook replace the module `check_point.mgmt.cp_mgmt_*` with the module `cp_mgmt_*`

0 commit comments

Comments
 (0)