Managing Security through API

This section describes the API Server on a Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. and the applicable API Tools.

API

You can configure and manage the Management Server through API Requests that you send to the API Server that runs on the Management Server.

The API Server can automate daily tasks and integrate Check Point solutions with 3rd-party systems, such as virtualization, ticketing, and change management systems.

To learn more about the management APIs, to see code samples, and to take advantage of user forums, see:

The API Documentation:

Online - Check Point Management API Reference (at the top, select the correct version)

Local - https://<Server IP Address>/api_docs

By default, access to the local API Documentation is disabled. Follow the instructions in sk174606.

Note - On a Standalone Configuration in which the Check Point Firewall and the Security Management Server products are installed and configured on the same server. server (a server which runs both a Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. and a Security Gateway), the API Documentation web portal (https://<Server IP Address>/api_docs) stops working when you open SmartView Web Application (https://<Server IP Address>/smartview).

The Developers Network section of Check Point CheckMates Community.

API Tools

You can use these tools to work with the API Server on the Management Server:

Standalone management tool, included with Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. operating system:

mgmt_cli
Standalone management tool, included with SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on.:

mgmt_cli.exe

You can copy this tool from the SmartConsole installation folder to other computers that run Windows operating system.
Web Services APIs that allow communication and data exchange between the clients and the Management Server over the HTTP protocol.

These APIs also let other Check Point processes communicate with the Management Server over the HTTPS protocol.

https://<IP Address of Management Server>/web_api/<command>

Configuring the API Server

To configure the API Server:

Connect with SmartConsole to the Security Management Server or applicable Domain Management Server.
From the left navigation panel, click Manage & Settings.
In the upper left section, click Blades.
In the Management API section, click Advanced Settings.

The Management API Settings window opens.

Configure the Startup Settings and the Access Settings.

Click OK.
In the upper left section, click Permissions & Administrators.
In the object of each applicable Administrator, make sure the assigned Permission Profile Predefined group of SmartConsole access permissions assigned to Domains and administrators. With this feature you can configure complex permissions for many administrators with one definition. allows access to Management API.
Instructions
1. Edit the Administrator object.
2. In the left panel, click General.
3. In the Permissions section, on the right side of the selected Permission Profile, click the eye icon.
  
  The Permission Profile object opens in the read-only view.
4. In the left panel, click Management.
5. The permission Management API Login has to be selected.
  
  If it is not selected, then close this window and edit this Permission Profile object.
  
  For more information, see Assigning Permission Profiles to Administrators.
6. Click Close.
Publish the SmartConsole session.

Restart the API Server on the Management Server with this command:

api restart

Notes:

On a Multi-Domain Server, you must run this command in the context of the applicable Domain Management Server:

mdsenv <IP Address or Name of Domain Management Server>

The output of this command must show:

API started successfully

Examine the status of the API server on the Management Server with this command:

api status

Notes:

The output of this command must show:

--------------------------------------------
Overall API Status: Started
--------------------------------------------

API readiness test SUCCESSFUL. The server is up and ready to receive connections

The output of this command may show the state of the "API" process as "Stopped" when API access is set to "All IP addresses that can be used for GUI clients", and more than 200 Trusted Clients are configured:

Processes:

Name      State     PID       More Information
-------------------------------------------------
API       Stopped   ...

Discarding API Sessions with Locks or Pending Changes

Open SmartConsole and API sessions that contain locks or unpublished changes are not automatically discarded. As a result, some sessions can remain open for extended periods.

The ENABLE_DISCARD_WORKSESSIONS_OLDER_THAN_DAYS environment variable controls whether stale open sessions are automatically discarded. By default, this variable is disabled, and open sessions with locks or unpublished changes remain available until they are manually discarded.

When enabled, the Security Management Server periodically evaluates open sessions and discards sessions that exceed the configured age threshold.

To configure automatic discard of stale sessions:

Connect to the Security Management Server or Multi-Domain Server using SSH.
Switch to Expert mode.
To enable automatic discard of open sessions that contain locks or unpublished changes, set ENABLE_DISCARD_WORKSESSIONS_OLDER_THAN_DAYS to "true".

Run:

MDS_FWDIR/scripts/reload_env_vars.sh -e "ENABLE_DISCARD_WORKSESSIONS_OLDER_THAN_DAYS=true"

$MDS_FWDIR/scripts/override_server_setting.sh -e ENABLE_DISCARD_WORKSESSIONS_OLDER_THAN_DAYS true
By default, only sessions which are open for more than 60 days are automatically discarded. To configure the number of days after which sessions are discarded, run:

$MDS_FWDIR/scripts/reload_env_vars.sh -e "DISCARD_WORKSESSIONS_OLDER_THAN_DAYS=<Number_of_Days>" $MDS_FWDIR/scripts/override_server_setting.sh -e DISCARD_WORKSESSIONS_OLDER_THAN_DAYS <Number_of_Days>

For example, to set the threshold to 30 days, run:

$MDS_FWDIR/scripts/reload_env_vars.sh -e "DISCARD_WORKSESSIONS_OLDER_THAN_DAYS=30" $MDS_FWDIR/scripts/override_server_setting.sh -e DISCARD_WORKSESSIONS_OLDER_THAN_DAYS 30

Result:

When ENABLE_DISCARD_WORKSESSIONS_OLDER_THAN_DAYS is set to "true":

The Security Management Server checks all open SmartConsole and API sessions one time per day.
If a session remains open longer than the number of days configured in DISCARD_WORKSESSIONS_OLDER_THAN_DAYS, the session is automatically discarded.