Multi-Domain Security Management Commands

In This Section: Managing Security through API and CLI cma_migrate cpmiquerybin fwm mcd mds_backup mds_restore mdscmd mdsenv mdsquerydb mdsstart and mdsstop mdsstart_customer mdsstat mdsstop_customer mgmt_cli migrate_global_policies threshold_config $MDSVERUTIL Creating a Domain Management Server Using XML to Export Settings for a Domain Management Server

For more information about Multi-Domain Server, see the R80.20Multi-Domain Security Management Administration Guide.

In addition, see Security Management Server Commands.

Managing Security through API and CLI

You can configure and control the Management Server with the new command line tools and through web services. You must first configure the API server.

The API server runs scripts that automate daily tasks and integrate the Check Point solutions with third party systems such as virtualization servers, ticketing systems, and change management systems.

You can use these tools to run API scripts on the Management Server:

• Standalone management tool, included with SmartConsole. You can copy this tool to computers that run Windows or Gaia operating system.
  • mgmt_cli.exe (for Windows operating system)
  • mgmt_cli (for Gaia operating system)
• Web Services API that allows communication and data exchange between the clients and the Management Server over the HTTP protocol. It also lets other Check Point processes communicate with the Management Server over the HTTPS protocol.

All API clients use the same port as the Gaia Portal.

To learn more about the management APIs, to see code samples, and to take advantage of user forums, see:

• The Online Check Point Management API Reference Guide.
• The Developers Network section of CheckMates.

Configuring the API Server

To configure the API Server:

1. In SmartConsole, go to Manage & Settings > Blades.
2. In the Management API section, click Advanced Settings.

   The Management API Settings window opens.

3. Configure the Startup Settings and the Access Settings.

API Settings

Startup Settings

Select Automatic start to automatically start the API server when you start or reboot the Management Server.

The Automatic start option is activated by default during Management Server installation, if the Management Server has more than 4GB of RAM installed. If the Management Server has less than 4GB of RAM, the Automatic Start is deactivated.

If you change the Automatic start option:

1. Publish the session changes in SmartConsole.
2. Run the api restart command on the Management Server.

Access Settings

Select one of these options to configure which SmartConsole clients connect to the API server:

• Management server only - Only the Management Server itself can connect to the API Server. This option only lets you use the mgmt_cli utility to send API requests. You cannot use SmartConsole or web services to send API requests.
• All IP addresses that can be used for GUI clients - You can send API requests from all IP addresses that are defined as Trusted Clients in SmartConsole. This includes requests from SmartConsole, Web services and the mgmt_cli utility.
• All IP addresses - You can send API requests from all IP addresses. This includes requests from SmartConsole, Web services and the mgmt_cli utility.