Cluster Management APIs

Introduction

The purpose of Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. APIs is to provide automation / orchestration of Check Point cluster in a way similar to simple-gateway APIs.

These Cluster APIs support common cluster operations - such as creating a new cluster object, modifying an existing cluster object (for example, adding or removing cluster members, manipulation of interfaces).

These Cluster APIs are called "simple" because they do not support all cluster object features.

For operations on cluster objects that are not provided by these APIs, use SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

List of APIs

API Category	API	Description
Asynchronous	`add simple-cluster`	Creates a new simple cluster object from scratch
	`set simple-cluster`	Modifies an existing simple cluster object
Synchronous	`show simple-cluster`	Shows an existing simple cluster object specified by its Name or UID
	`show simple-clusters`	Shows all existing simple cluster objects
	`delete simple-cluster`	Deletes an existing simple cluster object

API Examples

Example 1 - Adding a simple cluster object

API command:

Use this API to add a simple cluster object.

add simple-cluster

Once the API command finishes, and the session is published, a new cluster object appears in SmartConsole.

Prerequisite:

All Cluster Members must already be installed.
The applicable interfaces on each Cluster Member Security Gateway that is part of a cluster. must already be configured.

Example description:

A simple ClusterXL Cluster of Check Point Security Gateways that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Security Gateways are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) VSX VSLS cluster supports up to 13 Cluster Members. Note: In ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic. in High Availability A redundant cluster mode, where only one Cluster Member (Active member) processes all the traffic, while other Cluster Members (Standby members) are ready to be promoted to Active state if the current Active member fails. In the High Availability mode, the Cluster Virtual IP address (that represents the cluster on that network) is associated: (1) With physical MAC Address of Active member (2) With virtual MAC Address. Synonym: Active/Standby. Acronym: HA. mode called cluster1
With two cluster members called member1 and member2
With three interfaces: eth0 (external), eth1 (sync), and eth2 (internal)
Only the Firewall Software Blade Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. is enabled (the IPsec VPN Check Point Software Blade on a Security Gateway that provides a Site to Site VPN and Remote Access VPN access. blade is disabled)
Cluster software version is R80.20

Example cluster object topology:

Interface	Cluster	Member1	Member2
eth0 (External)	172.23.5.254 / 255.255.255.0	172.23.5.1 / 255.255.255.0	172.23.5.2 / 255.255.255.0
eth1 (Sync)	N / A	1.1.1.1 / 255.255.255.0	1.1.1.2 / 255.255.255.0
eth2 (Internal)	192.168.1.254 / 255.255.255.0	192.168.1.1 / 255.255.255.0	192.168.1.2 / 255.255.255.0

API example:

Important - In the API command you must use the same One-Time Password you used on Cluster Members during the First Time Configuration Wizard.

{
  "name" : "cluster1",
  "color" : "yellow",
  "version" : "R80.20",
  "ip-address" : "172.23.5.254",
  "os-name" : "Gaia", 
  "cluster-mode" : "cluster-xl-ha",
  "firewall" : true,
  "vpn" : false,
  "interfaces" : [ 
    {
      "name" : "eth0",
      "ip-address" : "172.23.5.254",
      "network-mask" : "255.255.255.0",
      "interface-type" : "cluster",
      "topology" : "EXTERNAL",
      "anti-spoofing" : "true"
    },
   {
      "name" : "eth1",
      "interface-type" : "sync",
      "topology" : "INTERNAL",
      "topology-settings": {
        "ip-address-behind-this-interface": "network defined by the interface ip and net mask",
         "interface-leads-to-dmz": false
      }
    },
    {
      "name" : "eth2",
      "ip-address" : "192.168.1.254",
      "network-mask" : "255.255.255.0",
      "interface-type" : "cluster",
      "topology" : "INTERNAL",
      "anti-spoofing" : "true",
      "topology-settings": {
        "ip-address-behind-this-interface": "network defined by the interface ip and net mask",
        "interface-leads-to-dmz": false
      }
    }
  ],
  "members" : [ {
    "name" : "member1",
    "one-time-password" : "abcd",
    "ip-address" : "172.23.5.1",
    "interfaces" : [
      {
      "name" : "eth0",
      "ip-address" : "172.23.5.1",
      "network-mask" : "255.255.255.0"
      },
      {
      "name" : "eth1",
      "ip-address" : "1.1.1.1",
      "network-mask" : "255.255.255.0"
      },
      {
      "name" : "eth2",
      "ip-address" : "192.168.1.1",
      "network-mask" : "255.255.255.0"
      }
    ]
    },
    {
    "name" : "member2",
    "one-time-password" : "abcd",
    "ip-address" : "172.23.5.2",
    "interfaces" : [ 
      {
      "name" : "eth0",
      "ip-address" : "172.23.5.2",
      "network-mask" : "255.255.255.0"
      },
      {
      "name" : "eth1",
      "ip-address" : "1.1.1.2",
      "network-mask" : "255.255.255.0"
      },
      {
      "name" : "eth2",
      "ip-address" : "192.168.1.2",
      "network-mask" : "255.255.255.0"
      }
    ]
   }
  ]
}

Example 2 - Modifying an existing cluster object - adding a cluster member

API command:

Use this API to add (scale up) Cluster Members.

set simple-cluster

Example description:

Adding a Cluster Member called member3.

Example cluster object topology:

Interface	Cluster	Member1	Member2	Member3
eth0 (External)	172.23.5.254 / 255.255.255.0	172.23.5.1 / 255.255.255.0	172.23.5.2 / 255.255.255.0	172.23.5.3 / 255.255.255.0
eth1 (Sync)	N / A	1.1.1.1 / 255.255.255.0	1.1.1.2 / 255.255.255.0	1.1.1.3 / 255.255.255.0
eth2 (Internal)	192.168.1.254 / 255.255.255.0	192.168.1.1 / 255.255.255.0	192.168.1.2 / 255.255.255.0	192.168.1.3 / 255.255.255.0

API example:

{
  "name" : "cluster1",
  "members" : { "add" :
    {
    "name" : "member3",
    "ipv4-address" : "172.23.5.3",
        "one-time-password" : "aaaa",
        "interfaces" : [ 
         {
           "name" : "eth0",
           "ip-address" : "172.23.5.3",
           "network-mask" : "255.255.255.0"
         },
        {
           "name" : "eth1",
           "ip-address" : "1.1.1.3",
           "network-mask" : "255.255.255.0"
         },
         {
           "name" : "eth2",
           "ip-address" : "192.168.1.3",
           "network-mask" : "255.255.255.0"
         }
        ]
    }
  }
}

Example 3 - Modifying an existing cluster object - removing a cluster member

API command:

Use this API to remove (scale down State of a Cluster Member during a failure when one of the Critical Devices reports its state as "problem": In ClusterXL, applies to the state of the Security Gateway component; in 3rd-party / OPSEC cluster, applies to the state of the State Synchronization mechanism. A Cluster Member in this state does not process any traffic passing through cluster.) Cluster Members.

set simple-cluster

Example description:

Removing a Cluster Member called member3.

Example cluster object topology:

Interface	Cluster	Member1	Member2	Member3
eth0 (External)	172.23.5.254 / 255.255.255.0	172.23.5.1 / 255.255.255.0	172.23.5.2 / 255.255.255.0	172.23.5.3 / 255.255.255.0
eth1 (Sync)	N / A	1.1.1.1 / 255.255.255.0	1.1.1.2 / 255.255.255.0	1.1.1.3 / 255.255.255.0
eth2 (Internal)	192.168.1.254 / 255.255.255.0	192.168.1.1 / 255.255.255.0	192.168.1.2 / 255.255.255.0	192.168.1.3 / 255.255.255.0

API example:

{
  "name" : "cluster1",
  "members" :  { "remove" : "member3" }
}

Example 4 - Modifying an existing cluster object - adding a cluster interface

API command:

Use this API to add a cluster interface An interface on a Cluster Member, whose Network Type was set as Cluster in SmartConsole in cluster object. This interface is monitored by cluster, and failure on this interface will cause cluster failover..

set simple-cluster

Example description:

Adding a cluster interface called eth3.

Example cluster object topology:

Interface	Cluster	Member1	Member2
eth0 (External)	172.23.5.254 / 255.255.255.0	172.23.5.1 / 255.255.255.0	172.23.5.2 / 255.255.255.0
eth1 (Sync)	N / A	1.1.1.1 / 255.255.255.0	1.1.1.2 / 255.255.255.0
eth2 (Internal)	192.168.1.254 / 255.255.255.0	192.168.1.1 / 255.255.255.0	192.168.1.2 / 255.255.255.0
eth3 (Internal)	10.10.10.254 / 255.255.255.0	10.10.10.1 / 255.255.255.0	10.10.10.2 / 255.255.255.0

API example:

{
  "name" : "cluster1",
  "interfaces" : { "add" :
    {
        "name" : "eth3",
        "ip-address" : "10.10.10.254",
        "ipv4-mask-length" : "24",
        "interface-type" : "cluster",
        "topology" : "INTERNAL",
        "anti-spoofing" : "true"
    }
  },
  "members" : { "update" :
    [{ 
    "name" : "member1" ,
    "interfaces" : 
      {"name" : "eth3",
      "ipv4-address" : "10.10.10.1",
      "ipv4-network-mask" : "255.255.255.0"}
    },
    { 
    "name" : "member2" ,
    "interfaces" : 
      {"name" : "eth3",
      "ipv4-address" : "10.10.10.2",
      "ipv4-network-mask" : "255.255.255.0"}
    }
    ]}
}

Example 5 - Modifying an existing cluster object - removing a cluster interface

API command:

Use this API to remove a cluster interface.

set simple-cluster

Example description:

Removing a cluster interface called eth3.

Example cluster object topology:

Interface	Cluster	Member1	Member2
eth0 (External)	172.23.5.254 / 255.255.255.0	172.23.5.1 / 255.255.255.0	172.23.5.2 / 255.255.255.0
eth1 (Sync)	N / A	1.1.1.1 / 255.255.255.0	1.1.1.2 / 255.255.255.0
eth2 (Internal)	192.168.1.254 / 255.255.255.0	192.168.1.1 / 255.255.255.0	192.168.1.2 / 255.255.255.0
eth3 (Internal)	10.10.10.254 / 255.255.255.0	10.10.10.1 / 255.255.255.0	10.10.10.2 / 255.255.255.0

API example:

{
  "name" : "cluster1",
  "interfaces" :  { "remove" : "eth3" }
}

Example 6 - Modifying an existing cluster object - changing settings of a cluster interface

API command:

Use this API to change settings of a cluster interface.

set simple-cluster

Example description:

Changing the IP address of the cluster interfaces called eth2 from 192.168.x.254 / 255.255.255.0 to 172.30.1.x / 255.255.255.0

Example cluster object topology:

Interface

Cluster

Member1

Member2

eth0 (External)

172.23.5.254 /
255.255.255.0

172.23.5.1 /
255.255.255.0

172.23.5.2 /
255.255.255.0

eth1 (Sync)

N / A

1.1.1.1 /
255.255.255.0

1.1.1.2 /
255.255.255.0

eth2 (Internal)

From:

192.168.1.254 /
255.255.255.0

To:

172.30.1.254 /
255.255.255.0

From:

192.168.1.1 /
255.255.255.0

To:

172.30.1.1 /
255.255.255.0

From:

192.168.1.2 /
255.255.255.0

To:

172.30.1.2 /
255.255.255.0

API example:

{
 "name" : "cluster1",
 "interfaces" : { "update" :
    {
      "name" : "eth2",
      "ip-address" : "172.30.1.254",
      "ipv4-mask-length" : "24",
      "interface-type" : "cluster",
      "topology" : "INTERNAL",
      "anti-spoofing" : "true"
    }
  },
  "members" : { "update" : [
  {
      "name" : "member1" ,
      "interfaces" :
        {"name" : "eth2",
        "ipv4-address" : "172.30.1.1",
        "ipv4-mask-length" : "24"}
    },
  {
      "name" : "member2" ,
      "interfaces" :
        {"name" : "eth2",
        "ipv4-address" : "172.30.1.2",
        "ipv4-mask-length" : "24"}
    }
  ]}
}

Example 8 - Modifying an existing cluster object - enabling / disabling blades

API command:

Use this API to enable and disable Software Blades on Cluster Members.

set simple-cluster

Notes:

To enable a Software Blade, set its value to true in the API command.
To disable a Software Blade, set its value to false in the API command.

API example:

To enable all Software Blades supported by the Cluster API:

{
   "name" : "cluster1",
   "vpn" : true,
   "application-control" : true,
   "url-filtering" : true,
   "ips" : true,
   "content-awareness" : true,
   "anti-bot" : true,
   "anti-virus" : true,
   "threat-emulation" : true
}

To disable all Software Blades supported by the Cluster API:

{
   "name" : "cluster1",
   "vpn" : false,
   "application-control" : false,
   "url-filtering" : false,
   "ips" : false,
   "content-awareness" : false,
   "anti-bot" : false,
   "anti-virus" : false,
   "threat-emulation" : false
}

Example 9 - Viewing an existing cluster object

API command:

Use this API to view a specific existing cluster object.

show simple-cluster

Note - By default, the output shows up to 50 configured cluster interfaces.

API example - request:

{
  "limit-interfaces" : "10",
  "name" : "cluster1"
}

API example - response:

{
    "uid": "e0ce560b-8a0a-4468-baa9-5f8eb2658b96",
    "name": "cluster1",
    "type": "simple-cluster",
    "domain": {
        "uid": "41e821a0-3720-11e3-aa6e-0800200c9fde",
        "name": "SMC User",
        "domain-type": "domain"
    },
    "meta-info": {
        "lock": "unlocked",
        "validation-state": "ok",
        "last-modify-time": {
            "posix": 1567417185885,
            "iso-8601": "2019-09-02T12:39+0300"
        },
        "last-modifier": "aa",
        "creation-time": {
            "posix": 1567417140278,
            "iso-8601": "2019-09-02T12:39+0300"
        },
        "creator": "aa"
    },
    "tags": [],
    "read-only": false,
    "comments": "",
    "color": "yellow",
    "icon": "NetworkObjects/cluster",
    "groups": [],
    "ipv4-address": "172.23.5.254",
    "dynamic-ip": false,
    "version": "R80.20",
    "os-name": "Gaia",
    "hardware": "Open server",
    "firewall": true,
    "firewall-settings": {
        "auto-maximum-limit-for-concurrent-connections": true,
        "maximum-limit-for-concurrent-connections": 25000,
        "auto-calculate-connections-hash-table-size-and-memory-pool": true,
        "connections-hash-size": 131072,
        "memory-pool-size": 6,
        "maximum-memory-pool-size": 30
    },
    "vpn": false,
    "application-control": false,
    "url-filtering": false,
    "content-awareness": false,
    "ips": false,
    "anti-bot": false,
    "anti-virus": false,
    "threat-emulation": false,
    "save-logs-locally": false,
    "send-alerts-to-server": [
        "harry-main-take-96"
    ],
    "send-logs-to-server": [
        "harry-main-take-96"
    ],
    "send-logs-to-backup-server": [],
    "logs-settings": {
        "rotate-log-by-file-size": false,
        "rotate-log-file-size-threshold": 1000,
        "rotate-log-on-schedule": false,
        "alert-when-free-disk-space-below-metrics": "mbytes",
        "alert-when-free-disk-space-below": true,
        "alert-when-free-disk-space-below-threshold": 3000,
        "alert-when-free-disk-space-below-type": "popup alert",
        "delete-when-free-disk-space-below-metrics": "mbytes",
        "delete-when-free-disk-space-below": true,
        "delete-when-free-disk-space-below-threshold": 5000,
        "before-delete-keep-logs-from-the-last-days": false,
        "before-delete-keep-logs-from-the-last-days-threshold": 0,
        "before-delete-run-script": false,
        "before-delete-run-script-command": "",
        "stop-logging-when-free-disk-space-below-metrics": "mbytes",
        "stop-logging-when-free-disk-space-below": true,
        "stop-logging-when-free-disk-space-below-threshold": 100,
        "reject-connections-when-free-disk-space-below-threshold": false,
        "reserve-for-packet-capture-metrics": "mbytes",
        "reserve-for-packet-capture-threshold": 500,
        "delete-index-files-when-index-size-above-metrics": "mbytes",
        "delete-index-files-when-index-size-above": false,
        "delete-index-files-when-index-size-above-threshold": 100000,
        "delete-index-files-older-than-days": false,
        "delete-index-files-older-than-days-threshold": 14,
        "forward-logs-to-log-server": false,
        "perform-log-rotate-before-log-forwarding": false,
        "update-account-log-every": 3600,
        "detect-new-citrix-ica-application-names": false,
        "turn-on-qos-logging": true
    },
    "interfaces": {
        "total": 3,
        "from": 1,
        "to": 3,
        "objects": [
            {
                "name": "eth0",
                "ipv4-address": "172.23.5.254",
                "ipv4-network-mask": "255.255.255.0",
                "ipv4-mask-length": 24,
                "ipv6-address": "",
                "topology": "external",
                "anti-spoofing": true,
                "anti-spoofing-settings": {
                    "action": "prevent"
                },
                "security-zone": false,
                "comments": "",
                "color": "black",
                "icon": "NetworkObjects/network",
                "interface-type": "cluster"
            },
            {
                "name": "eth1",
                "ipv4-address": "1.1.1.0",
                "ipv4-network-mask": "255.255.255.0",
                "ipv4-mask-length": 24,
                "ipv6-address": "",
                "topology": "internal",
                "topology-settings": {
                    "ip-address-behind-this-interface": "network defined by the interface ip and net mask",
                    "interface-leads-to-dmz": false
                },
                "anti-spoofing": false,
                "security-zone": false,
                "comments": "",
                "color": "black",
                "icon": "NetworkObjects/network",
                "interface-type": "sync"
            },
            {
                "name": "eth2",
                "ipv4-address": "192.168.1.254",
                "ipv4-network-mask": "255.255.255.0",
                "ipv4-mask-length": 24,
                "ipv6-address": "",
                "topology": "internal",
                "topology-settings": {
                    "ip-address-behind-this-interface": "network defined by the interface ip and net mask",
                    "interface-leads-to-dmz": false
                },
                "anti-spoofing": true,
                "anti-spoofing-settings": {
                    "action": "prevent"
                },
                "security-zone": false,
                "comments": "",
                "color": "black",
                "icon": "NetworkObjects/network",
                "interface-type": "cluster"
            }
        ]
    },
    "cluster-mode": "cluster-xl-ha",
    "cluster-members": [
        {
            "name": "member1",
            "sic-state": "initialized",
            "sic-message": "Initialized but trust not established",
            "ip-address": "172.23.5.1",
            "interfaces": [
                {
                    "name": "eth0",
                    "ipv4-address": "172.23.5.1",
                    "ipv4-network-mask": "255.255.255.0",
                    "ipv4-mask-length": 24,
                    "ipv6-address": "",
                    "ipv6-network-mask": "::",
                    "ipv6-mask-length": 0
                },
                {
                    "name": "eth1",
                    "ipv4-address": "1.1.1.1",
                    "ipv4-network-mask": "255.255.255.0",
                    "ipv4-mask-length": 24,
                    "ipv6-address": "",
                    "ipv6-network-mask": "::",
                    "ipv6-mask-length": 0
                },
                {
                    "name": "eth2",
                    "ipv4-address": "192.168.1.1",
                    "ipv4-network-mask": "255.255.255.0",
                    "ipv4-mask-length": 24,
                    "ipv6-address": "",
                    "ipv6-network-mask": "::",
                    "ipv6-mask-length": 0
                }
            ]
        },
        {
            "name": "member2",
            "sic-state": "initialized",
            "sic-message": "Initialized but trust not established",
            "ip-address": "172.23.5.3",
            "interfaces": [
                {
                    "name": "eth0",
                    "ipv4-address": "172.23.5.2",
                    "ipv4-network-mask": "255.255.255.0",
                    "ipv4-mask-length": 24,
                    "ipv6-address": "",
                    "ipv6-network-mask": "::",
                    "ipv6-mask-length": 0
                },
                {
                    "name": "eth1",
                    "ipv4-address": "1.1.1.2",
                    "ipv4-network-mask": "255.255.255.0",
                    "ipv4-mask-length": 24,
                    "ipv6-address": "",
                    "ipv6-network-mask": "::",
                    "ipv6-mask-length": 0
                },
                {
                    "name": "eth2",
                    "ipv4-address": "192.168.1.2",
                    "ipv4-network-mask": "255.255.255.0",
                    "ipv4-mask-length": 24,
                    "ipv6-address": "",
                    "ipv6-network-mask": "::",
                    "ipv6-mask-length": 0
                }
            ]
        }
    ]
}

Known Limitations

These Cluster APIs support only subset of cluster operations.
These Cluster APIs support only basic configuration of Software Blades (similar to "simple-gateway" APIs - see the Check Point Management API Reference).
These Cluster APIs support only ClusterXL High Availability, ClusterXL Load Sharing A redundant cluster mode, where all Cluster Members process all incoming traffic in parallel. For more information, see "Load Sharing Multicast Mode" and "Load Sharing Unicast Mode". Synonyms: Active/Active, Load Balancing mode. Acronym: LS., and CloudGuard OPSEC clusters.
These Cluster APIs do not support the configuration of a Cluster Virtual IP address on a different subnet than the IP addresses of the Cluster Members.

For such configuration, use SmartConsole.
These Cluster APIs do not support VRRP Clusters (either on Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. OS or IPSO OS).
These Cluster APIs support a limited subset of interface settings.

To change interface settings such as Topology, Anti-Spoofing and Security Zone, you must replace the interface.