Managing Security through API and CLI

You can configure and control the Management Server with the new command line tools and through web services. You must first configure the API server.

The API server runs scripts that automate daily tasks and integrate the Check Point solutions with third party systems such as virtualization servers, ticketing systems, and change management systems.

You can use these tools to run API scripts on the Management Server:

• Standalone management tool, included with SmartConsole. You can copy this tool to computers that run Windows or Gaia operating system.
  • mgmt_cli.exe (for Windows operating system)
  • mgmt_cli (for Gaia operating system)
• Web Services API that allows communication and data exchange between the clients and the Management Server over the HTTP protocol. It also lets other Check Point processes communicate with the Management Server over the HTTPS protocol.

All API clients use the same port as the Gaia Portal.

To learn more about the management APIs, to see code samples, and to take advantage of user forums, see:

• The Online Check Point Management API Reference Guide.
• The Developers Network section of CheckMates.

Configuring the API Server

To configure the API Server:

1. In SmartConsole, go to Manage & Settings > Blades.
2. In the Management API section, click Advanced Settings.

   The Management API Settings window opens.

3. Configure the Startup Settings and the Access Settings.

Management API Settings

• Startup Settings
  • Select Automatic start to automatically start the API server when the Security Management Server starts.

    In these environments, Automatic start is selected by default:

    • Distributed Security Management Servers (without gateway functionality) with at least 4GB of RAM
    • Standalone Security Management Servers (with gateway functionality) with at least 8GB of RAM

  In other environments, to reduce the memory consumption on the management server, Automatic start is not selected by default.

• Access Settings

  Configure IP addresses from which the API server accepts requests:

  • Management server only (default) - API server will accept scripts and web service requests only from the Security Management Server. You must open a command line interface on the server and use the mgmt_cli utility to send API requests.
  • All IP addresses that can be used for GUI clients - API server will accept scripts and web service requests from the same devices that are allowed access to the Security Management Server.
  • All IP addresses - API server will accept scripts and web-service requests from any device.

To apply changes, you must publish the session, and run the api restart command on the Security Management Server.