How to automate Checkpoint firewalls rules implementation?

Question

I HATE CP with a passion beyond belief... I mean, why, WHY you couldn't include a command line interface that allows me to grep a CSV file in which I'm requested rules, format them properly and then send them to the firewall??? Unless I'm missing something, there's no way to add access rules to a CP FW based on a text file, correct?

ANY way to automate my job (or part of it), so I don't waste countless hours of my life being a simple interface between a requestor & a firewall?

So far, the only thing I could think of is creating a script that: 1) Gets the Excel file from the Remedy system 2) Converts it to CSV 3) Check the source & destination IP addresses and add a column indicating in which FW I need to do the change.

Answer 1

The security policy of Check Point is based on objects of many types so simple flat CSV is almost impossible. If we take into account tools available directly from Check Point there are three possibilities but unfortunately none of them is ideal:

cp_merge

This tool allows export and import of objects and policy. The exported policy can possibly be manipulated. Import allows overwriting or appending.

• sk59840: How To Use cp_merge to Manipulate Security Policies

dbedit

This is a universal tool which allows objects and rulebase manipulation. See the CLI guide and the following:

• sk30383: Using a dbedit script to create new network objects and network object groups
• sk76040: How to use dbedit to create automatic NAT on host object

Unfortunately the manipulation of rules is not documented but you can download Ofiller and study the generated dbedit scripts. Ofiller is a great tool but unfortunately it has not been updated for a long time and I am not sure how reliable is it with the current versions of the Check Point software.

Confwiz

This is an official tool and it was originally intended that Confwiz will allow import/export/migration of security policy between multiple platforms. At the beginning Cisco formats were supported but unfortunately there the effort of Check Point stopped. The newest versions of Check Point software supported by Confwiz are R71.x and it seems that development of Confwiz stopped completely.

• Confwiz Administration Guide

Other possibilities

You can edit the files in the $FWDIR/conf directory directly but you have to be very careful and this is not supported by Check Point.

There is also official Web Visualization Tool which allows export to XML but no import.

Probably there are some third party tools but as far as I know only Ofiller is a free one.

Answer 2

Check Point does have an API when it comes to automation. I wouldn't do anything outside of this or DBEdit, but that's me personally. I also recommend third-party tools for it like Algosec, but you may not have the budget. R80 is supposed to have a better API, but it's still not going to get close to the likes of Palo that I've seen.

CSV file sounds to me like you are used to managing the likes of Cisco ASA which is much worse and very archaic if you ask me. Learn to integrate with APIs and keep your focus there as that is where the world is headed everywhere in the network stack.