|
1 | | -# CheckPointAnsibleMgmtCollection |
2 | | -CheckPointAnsibleMgmtCollection |
| 1 | +# Check Point Ansible Mgmt Collection |
| 2 | +This Ansible collection provides control over a Check Point management server using |
| 3 | +Check Point's web-services APIs. |
| 4 | + |
| 5 | +The Ansible Check Point moduules reference can be found here: |
| 6 | +https://docs.ansible.com/ansible/latest/modules/list_of_network_modules.html#check-point |
| 7 | +Note - look only at the `cp_mgmt_*` modules, cause the `checkpoint_*` will be depricated. |
| 8 | + |
| 9 | +Installation instructions |
| 10 | +------------------------- |
| 11 | +Run `ansible-galaxy collection install check_point.mgmt` |
| 12 | + |
| 13 | +Requirements |
| 14 | +------------ |
| 15 | +* Ansible 2.9+ is required. |
| 16 | +* The Check Point server should be using the versions detailed in this SK: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114661 |
| 17 | +* The Check Point server should be open for API communication from the ansible server. |
| 18 | + Open SmartConsole ans check "Manage & Settings > Blades > Management API > Advanced settings". |
| 19 | + |
| 20 | +Usage |
| 21 | +----- |
| 22 | +1. Edit the `hosts` so that it would contain a section similar to this one: |
| 23 | +``` |
| 24 | +[check_point] |
| 25 | +%YOUR_IP% |
| 26 | +[checkpoint:vars] |
| 27 | +ansible_httpapi_use_ssl=True |
| 28 | +ansible_httpapi_validate_certs=False |
| 29 | +ansible_user=%YOUR_USER% |
| 30 | +ansible_password=%YOUR_PASSWORD% |
| 31 | +ansible_network_os=check_point.mgmt.checkpoint |
| 32 | +``` |
| 33 | +Note - If you want to run against Ansible version 2.9 instead of the collection, just replace `ansible_network_os=check_point.mgmt.checkpoint` with `ansible_network_os=checkpoint` |
| 34 | +2. Run a playbook: |
| 35 | +```sh |
| 36 | +ansible-playbook your_ansible_playbook.yml |
| 37 | +``` |
| 38 | +or |
| 39 | + |
| 40 | +Run a playbook in "check mode": |
| 41 | +```sh |
| 42 | +ansible-playbook -C your_ansible_playbook.yml |
| 43 | +``` |
| 44 | +Example playbook: |
| 45 | +``` |
| 46 | +--- |
| 47 | +- name: playbook name |
| 48 | + hosts: checkpoint |
| 49 | + connection: httpapi |
| 50 | + tasks: |
| 51 | + - name: task to have network |
| 52 | + check_point.mgmt.cp_mgmt_network: |
| 53 | + name: "network name" |
| 54 | + subnet: "4.1.76.0" |
| 55 | + mask_length: 24 |
| 56 | + auto_publish_session: true |
| 57 | + |
| 58 | + vars: |
| 59 | + ansible_checkpoint_domain: "SMC User" |
| 60 | +``` |
| 61 | +Note - If you want to run against Ansible version 2.9 instead of the collection, just replace `check_point.mgmt.cp_mgmt_network` with `cp_mgmt_network` |
| 62 | + |
| 63 | +### Notes: |
| 64 | + 1. Because this Ansible module is controlling the management server remotely via the web API, |
| 65 | + the ansible server needs to have access to the Check Point API server. |
| 66 | + Open `SmartConsole`, navigate to "Manage & Settings > Blades > Management API > Advanced settings" |
| 67 | + and check the API server's accessibility set |
| 68 | + 2. Ansible has a feature called "Check Mode" that enables you to test the |
| 69 | + changes without actually changing anything. |
| 70 | + 3. The login and logout happens automatically. |
| 71 | + 4. If you want to login to specific domain, in the playbook above in the `vars`secion insert the domain name to |
| 72 | + `ansible_checkpoint_domain` |
| 73 | + 5. There are two ways to publish changes: |
| 74 | + a. Set the `auto_publish_session` to `true` as displayed in the example playbook above. |
| 75 | + This option will publish only the task which this parameter belongs to. |
| 76 | + b. Add the task to publish with the `cp_mgmt_publish` module. |
| 77 | + This option will publish all the tasks above this task. |
| 78 | + 6. It is recommended by Check Point to use this collection over the modules of Ansible version 2.9 |
| 79 | + 7. If you still want to use Ansible version 2.9 instead of this collection (not recommended): |
| 80 | + a. In the `hosts` file replace `ansible_network_os=check_point.mgmt.checkpoint` with `ansible_network_os=checkpoint` |
| 81 | + b. In the task in the playbook replace the module `check_point.mgmt.cp_mgmt_*` with the module `cp_mgmt_*` |
0 commit comments