check_point.mgmt.cp_mgmt_simple_gateway module – Manages simple-gateway objects on Check Point over Web Services API

Note

This module is part of the check_point.mgmt collection (version 7.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install check_point.mgmt.

To use it in a playbook, specify: check_point.mgmt.cp_mgmt_simple_gateway.

New in check_point.mgmt 1.0.0

Synopsis

  • Manages simple-gateway objects on Check Point devices including creating, updating and removing objects.

  • All operations are performed over Web Services API.

  • Available from R80 management version.

Parameters

Parameter

Comments

anti_bot

boolean

Anti-Bot blade enabled.

Choices:

  • false

  • true

anti_virus

boolean

Anti-Virus blade enabled.

Choices:

  • false

  • true

application_control

boolean

Application Control blade enabled.

Choices:

  • false

  • true

auto_publish_session

boolean

Publish the current session if changes have been performed after task completes.

Choices:

  • false ← (default)

  • true

color

string

Color of the object. Should be one of existing colors.

Choices:

  • "aquamarine"

  • "black"

  • "blue"

  • "crete blue"

  • "burlywood"

  • "cyan"

  • "dark green"

  • "khaki"

  • "orchid"

  • "dark orange"

  • "dark sea green"

  • "pink"

  • "turquoise"

  • "dark blue"

  • "firebrick"

  • "brown"

  • "forest green"

  • "gold"

  • "dark gold"

  • "gray"

  • "dark gray"

  • "light green"

  • "lemon chiffon"

  • "coral"

  • "sea green"

  • "sky blue"

  • "magenta"

  • "purple"

  • "slate blue"

  • "violet red"

  • "navy blue"

  • "olive"

  • "orange"

  • "red"

  • "sienna"

  • "yellow"

comments

string

Comments string.

content_awareness

boolean

Content Awareness blade enabled.

Available from R80.10 management version.

Choices:

  • false

  • true

details_level

string

The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object.

Choices:

  • "uid"

  • "standard"

  • "full"

enable_https_inspection

boolean

Enable HTTPS Inspection after defining an outbound inspection certificate. <br>To define the outbound certificate use outbound inspection certificate API.

Choices:

  • false

  • true

firewall

boolean

Firewall blade enabled.

Choices:

  • false

  • true

firewall_settings

dictionary

N/A

auto_calculate_connections_hash_table_size_and_memory_pool

boolean

N/A

Choices:

  • false

  • true

auto_maximum_limit_for_concurrent_connections

boolean

N/A

Choices:

  • false

  • true

connections_hash_size

integer

N/A

maximum_limit_for_concurrent_connections

integer

N/A

maximum_memory_pool_size

integer

N/A

memory_pool_size

integer

N/A

gateway_version

string

Gateway platform version.

groups

list / elements=string

Collection of group identifiers.

identity_awareness

boolean

added in check_point.mgmt 7.0.0

Identity awareness blade enabled.

Choices:

  • false

  • true

identity_awareness_settings

dictionary

added in check_point.mgmt 7.0.0

Gateway Identity Awareness settings.

browser_based_authentication

boolean

Enable Browser Based Authentication source.

Choices:

  • false

  • true

browser_based_authentication_settings

dictionary

Browser Based Authentication settings.

authentication_settings

dictionary

Authentication Settings for Browser Based Authentication.

authentication_method

string

Authentication method.

Choices:

  • "username and password"

  • "defined on user record"

  • "identity provider"

  • "radius"

identity_provider

list / elements=string

Identity provider object identified by the name or UID. Must be set when “authentication-method” was selected to be “identity provider”.

radius

string

Radius server object identified by the name or UID. Must be set when “authentication-method” was selected to be “radius”.

users_directories

dictionary

Users directories.

external_user_profile

boolean

External user profile.

Choices:

  • false

  • true

internal_users

boolean

Internal users.

Choices:

  • false

  • true

specific

list / elements=string

LDAP AU objects identified by the name or UID. Must be set when “users-from-external-directories” was selected to be “specific”.

users_from_external_directories

string

Users from external directories.

Choices:

  • "all gateways directories"

  • "specific"

  • "none"

browser_based_authentication_portal_settings

dictionary

Browser Based Authentication portal settings.

accessibility

dictionary

Configuration of the portal access settings.

allow_access_from

string

Allowed access to the web portal (based on interfaces, or security policy).

Choices:

  • "rule_base"

  • "internal_interfaces"

  • "all_interfaces"

internal_access_settings

dictionary

Configuration of the additional portal access settings for internal interfaces only.

dmz

boolean

Controls portal access settings for internal interfaces, whose topology is set to ‘DMZ’.

Choices:

  • false

  • true

undefined

boolean

Controls portal access settings for internal interfaces, whose topology is set to ‘Undefined’.

Choices:

  • false

  • true

vpn

boolean

Controls portal access settings for interfaces that are part of a VPN Encryption Domain.

Choices:

  • false

  • true

certificate_settings

dictionary

Configuration of the portal certificate settings.

base64_certificate

string

The certificate file encoded in Base64 with padding. This file must be in the *.p12 format.

base64_password

string

Password (encoded in Base64 with padding) for the certificate file.

portal_web_settings

dictionary

Configuration of the portal web settings.

aliases

list / elements=string

List of URL aliases that are redirected to the main portal URL.

ip_address

string

Optional, IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. Note, If your DNS server resolves the main portal URL, this IP address is ignored.

main_url

string

The main URL for the web portal.

identity_agent

boolean

Enable Identity Agent source.

Choices:

  • false

  • true

identity_agent_settings

dictionary

Identity Agent settings.

agents_interval_keepalive

integer

Agents send keepalive period (minutes).

authentication_settings

dictionary

Authentication Settings for Identity Agent.

authentication_method

string

Authentication method.

Choices:

  • "username and password"

  • "defined on user record"

  • "radius"

radius

string

Radius server object identified by the name or UID. Must be set when “authentication-method” was selected to be “radius”.

users_directories

dictionary

Users directories.

external_user_profile

boolean

External user profile.

Choices:

  • false

  • true

internal_users

boolean

Internal users.

Choices:

  • false

  • true

specific

list / elements=string

LDAP AU objects identified by the name or UID. Must be set when “users-from-external-directories” was selected to be “specific”.

users_from_external_directories

string

Users from external directories.

Choices:

  • "all gateways directories"

  • "specific"

  • "none"

identity_agent_portal_settings

dictionary

Identity Agent accessibility settings.

accessibility

dictionary

Configuration of the portal access settings.

allow_access_from

string

Allowed access to the web portal (based on interfaces, or security policy).

Choices:

  • "rule_base"

  • "internal_interfaces"

  • "all_interfaces"

internal_access_settings

dictionary

Configuration of the additional portal access settings for internal interfaces only.

dmz

boolean

Controls portal access settings for internal interfaces, whose topology is set to ‘DMZ’.

Choices:

  • false

  • true

undefined

boolean

Controls portal access settings for internal interfaces, whose topology is set to ‘Undefined’.

Choices:

  • false

  • true

vpn

boolean

Controls portal access settings for interfaces that are part of a VPN Encryption Domain.

Choices:

  • false

  • true

user_reauthenticate_interval

integer

Agent reauthenticate time interval (minutes).

identity_based_enforcement

string

ON, Configures this object as a PEP-only object - identity-based enforcement (PEP) is enabled.<br>OFF, Configures this object as a PDP-only object - identity-based enforcement is disabled.

Choices:

  • "on"

  • "off"

identity_collector

boolean

Enable Identity Collector source.

Choices:

  • false

  • true

identity_collector_settings

dictionary

Identity Collector settings.

authentication_settings

dictionary

Authentication Settings for Identity Collector.

users_directories

dictionary

Users directories.

external_user_profile

boolean

External user profile.

Choices:

  • false

  • true

internal_users

boolean

Internal users.

Choices:

  • false

  • true

specific

list / elements=string

LDAP AU objects identified by the name or UID. Must be set when “users-from-external-directories” was selected to be “specific”.

users_from_external_directories

string

Users from external directories.

Choices:

  • "all gateways directories"

  • "specific"

  • "none"

authorized_clients

list / elements=dictionary

Authorized Clients.

client

string

Host / Network Group Name or UID.

client_secret

string

Client Secret.

client_access_permissions

dictionary

Identity Collector accessibility settings.

accessibility

dictionary

Configuration of the portal access settings.

allow_access_from

string

Allowed access to the web portal (based on interfaces, or security policy).

Choices:

  • "rule_base"

  • "internal_interfaces"

  • "all_interfaces"

internal_access_settings

dictionary

Configuration of the additional portal access settings for internal interfaces only.

dmz

boolean

Controls portal access settings for internal interfaces, whose topology is set to ‘DMZ’.

Choices:

  • false

  • true

undefined

boolean

Controls portal access settings for internal interfaces, whose topology is set to ‘Undefined’.

Choices:

  • false

  • true

vpn

boolean

Controls portal access settings for interfaces that are part of a VPN Encryption Domain.

Choices:

  • false

  • true

identity_sharing_settings

dictionary

Identity sharing settings.

cache_mode

dictionary

True, In case of connectivity loss from the Policy-Decision-Point (PDP), extend Identity cache up-to “cache-mode-duration”.<br>False, Identity Cache Mode is disabled, in case of connectivity loss from the Policy-Decision-Point, existing Identities will be lost immediately.

override_profile

boolean

Override profile of global configuration.

Choices:

  • false

  • true

value

boolean

Override value.<br><font color=”red”>Required only for</font> ‘override-profile’ is True.

Choices:

  • false

  • true

cache_mode_duration

dictionary

Time limit for keeping Identities in the cache.

override_profile

boolean

Override profile of global configuration.

Choices:

  • false

  • true

value

integer

Override value.<br><font color=”red”>Required only for</font> ‘override-profile’ is True. Valid values are in the range 1-2880.

receive_from

list / elements=string

Gateway(s) to receive identity from.

receive_from_infinity_identity

boolean

Enable receiving identities from Infinity Identity.

Choices:

  • false

  • true

receive_from_other_gateways

boolean

Enable receiving identity from other gateways.

Choices:

  • false

  • true

scaled_sharing

boolean

Enable Scaled Sharing.

Choices:

  • false

  • true

share_with_other_gateways

boolean

Enable identity sharing with other gateways.

Choices:

  • false

  • true

identity_web_api

boolean

Enable Identity Web API source.

Choices:

  • false

  • true

identity_web_api_settings

dictionary

Identity Web API settings.

authentication_settings

dictionary

Authentication Settings for Identity Web Api.

users_directories

dictionary

Users directories.

external_user_profile

boolean

External user profile.

Choices:

  • false

  • true

internal_users

boolean

Internal users.

Choices:

  • false

  • true

specific

list / elements=string

LDAP AU objects identified by the name or UID. Must be set when “users-from-external-directories” was selected to be “specific”.

users_from_external_directories

string

Users from external directories.

Choices:

  • "all gateways directories"

  • "specific"

  • "none"

authorized_clients

list / elements=dictionary

Authorized Clients.

client

string

Host / Network Group Name or UID.

client_secret

string

Client Secret.

client_access_permissions

dictionary

Identity Web Api accessibility settings.

accessibility

dictionary

Configuration of the portal access settings.

allow_access_from

string

Allowed access to the web portal (based on interfaces, or security policy).

Choices:

  • "rule_base"

  • "internal_interfaces"

  • "all_interfaces"

internal_access_settings

dictionary

Configuration of the additional portal access settings for internal interfaces only.

dmz

boolean

Controls portal access settings for internal interfaces, whose topology is set to ‘DMZ’.

Choices:

  • false

  • true

undefined

boolean

Controls portal access settings for internal interfaces, whose topology is set to ‘Undefined’.

Choices:

  • false

  • true

vpn

boolean

Controls portal access settings for interfaces that are part of a VPN Encryption Domain.

Choices:

  • false

  • true

proxy_settings

dictionary

Identity-Awareness Proxy settings.

detect_using_x_forward_for

boolean

Whether to use X-Forward-For HTTP header, which is added by the proxy server to keep track of the original source IP.

Choices:

  • false

  • true

remote_access

boolean

Enable Remote Access Identity source.

Choices:

  • false

  • true

ignore_errors

boolean

Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.

Choices:

  • false

  • true

ignore_warnings

boolean

Apply changes ignoring warnings.

Choices:

  • false

  • true

interfaces

list / elements=dictionary

Network interfaces. When a gateway is updated with a new interfaces, the existing interfaces are removed.

anti_spoofing

boolean

N/A

Choices:

  • false

  • true

anti_spoofing_settings

dictionary

N/A

action

string

If packets will be rejected (the Prevent option) or whether the packets will be monitored (the Detect option).

Choices:

  • "prevent"

  • "detect"

color

string

Color of the object. Should be one of existing colors.

Choices:

  • "aquamarine"

  • "black"

  • "blue"

  • "crete blue"

  • "burlywood"

  • "cyan"

  • "dark green"

  • "khaki"

  • "orchid"

  • "dark orange"

  • "dark sea green"

  • "pink"

  • "turquoise"

  • "dark blue"

  • "firebrick"

  • "brown"

  • "forest green"

  • "gold"

  • "dark gold"

  • "gray"

  • "dark gray"

  • "light green"

  • "lemon chiffon"

  • "coral"

  • "sea green"

  • "sky blue"

  • "magenta"

  • "purple"

  • "slate blue"

  • "violet red"

  • "navy blue"

  • "olive"

  • "orange"

  • "red"

  • "sienna"

  • "yellow"

comments

string

Comments string.

details_level

string

The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object.

Choices:

  • "uid"

  • "standard"

  • "full"

ignore_errors

boolean

Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.

Choices:

  • false

  • true

ignore_warnings

boolean

Apply changes ignoring warnings.

Choices:

  • false

  • true

ip_address

string

IPv4 or IPv6 address. If both addresses are required use ipv4-address and ipv6-address fields explicitly.

ipv4_address

string

IPv4 address.

ipv4_mask_length

string

IPv4 network mask length.

ipv4_network_mask

string

IPv4 network address.

ipv6_address

string

IPv6 address.

ipv6_mask_length

string

IPv6 network mask length.

ipv6_network_mask

string

IPv6 network address.

mask_length

string

IPv4 or IPv6 network mask length.

name

string

Object name.

network_mask

string

IPv4 or IPv6 network mask. If both masks are required use ipv4-network-mask and ipv6-network-mask fields explicitly. Instead of providing mask itself it is possible to specify IPv4 or IPv6 mask length in mask-length field. If both masks length are required use ipv4-mask-length and ipv6-mask-length fields explicitly.

security_zone

boolean

N/A

Choices:

  • false

  • true

security_zone_settings

dictionary

N/A

auto_calculated

boolean

Security Zone is calculated according to where the interface leads to.

Choices:

  • false

  • true

specific_zone

string

Security Zone specified manually.

tags

list / elements=string

Collection of tag identifiers.

topology

string

N/A

Choices:

  • "automatic"

  • "external"

  • "internal"

topology_settings

dictionary

N/A

interface_leads_to_dmz

boolean

Whether this interface leads to demilitarized zone (perimeter network).

Choices:

  • false

  • true

ip_address_behind_this_interface

string

N/A

Choices:

  • "not defined"

  • "network defined by the interface ip and net mask"

  • "network defined by routing"

  • "specific"

specific_network

string

Network behind this interface.

ip_address

string

IPv4 or IPv6 address. If both addresses are required use ipv4-address and ipv6-address fields explicitly.

ips

boolean

Intrusion Prevention System blade enabled.

Choices:

  • false

  • true

ips_settings

dictionary

added in check_point.mgmt 6.5.0

Gateway IPS settings.

Available from R82 JHF management version.

activation_mode

string

Defines whether the IPS blade operates in Detect Only mode or enforces the configured IPS Policy.

Choices:

  • "according-to-policy"

  • "detect-only"

bypass_all_under_load

boolean

Disable/enable all IPS protections until CPU and memory levels are back to normal.

Choices:

  • false

  • true

bypass_track_method

string

Track options when all IPS protections are disabled until CPU/memory levels are back to normal.

Choices:

  • "none"

  • "log"

  • "popup alert"

  • "mail alert"

  • "snmp trap alert"

  • "user defined alert no.1"

  • "user defined alert no.2"

  • "user defined alert no.3"

cpu_usage_high_threshold

integer

CPU usage high threshold percentage (1-99).

cpu_usage_low_threshold

integer

CPU usage low threshold percentage (1-99).

memory_usage_high_threshold

integer

Memory usage high threshold percentage (1-99).

memory_usage_low_threshold

integer

Memory usage low threshold percentage (1-99).

send_threat_cloud_info

boolean

Help improve Check Point Threat Prevention product by sending anonymous information.

Choices:

  • false

  • true

ipv4_address

string

IPv4 address.

ipv6_address

string

IPv6 address.

logs_settings

dictionary

N/A

alert_when_free_disk_space_below

boolean

N/A

Choices:

  • false

  • true

alert_when_free_disk_space_below_threshold

integer

N/A

alert_when_free_disk_space_below_type

string

N/A

Choices:

  • "none"

  • "log"

  • "popup alert"

  • "mail alert"

  • "snmp trap alert"

  • "user defined alert no.1"

  • "user defined alert no.2"

  • "user defined alert no.3"

before_delete_keep_logs_from_the_last_days

boolean

N/A

Choices:

  • false

  • true

before_delete_keep_logs_from_the_last_days_threshold

integer

N/A

before_delete_run_script

boolean

N/A

Choices:

  • false

  • true

before_delete_run_script_command

string

N/A

delete_index_files_older_than_days

boolean

N/A

Choices:

  • false

  • true

delete_index_files_older_than_days_threshold

integer

N/A

delete_index_files_when_index_size_above

boolean

N/A

Choices:

  • false

  • true

delete_index_files_when_index_size_above_threshold

integer

N/A

delete_when_free_disk_space_below

boolean

N/A

Choices:

  • false

  • true

delete_when_free_disk_space_below_threshold

integer

N/A

detect_new_citrix_ica_application_names

boolean

N/A

Choices:

  • false

  • true

distribute_logs_between_all_active_servers

boolean

added in check_point.mgmt 7.0.0

Distribute logs between all active servers.

Choices:

  • false

  • true

forward_logs_to_log_server

boolean

N/A

Choices:

  • false

  • true

forward_logs_to_log_server_name

string

N/A

forward_logs_to_log_server_schedule_name

string

N/A

free_disk_space_metrics

string

N/A

Choices:

  • "mbytes"

  • "percent"

perform_log_rotate_before_log_forwarding

boolean

N/A

Choices:

  • false

  • true

reject_connections_when_free_disk_space_below_threshold

boolean

N/A

Choices:

  • false

  • true

reserve_for_packet_capture_metrics

string

N/A

Choices:

  • "percent"

  • "mbytes"

reserve_for_packet_capture_threshold

integer

N/A

rotate_log_by_file_size

boolean

N/A

Choices:

  • false

  • true

rotate_log_file_size_threshold

integer

N/A

rotate_log_on_schedule

boolean

N/A

Choices:

  • false

  • true

rotate_log_schedule_name

string

N/A

stop_logging_when_free_disk_space_below

boolean

N/A

Choices:

  • false

  • true

stop_logging_when_free_disk_space_below_threshold

integer

N/A

turn_on_qos_logging

boolean

N/A

Choices:

  • false

  • true

update_account_log_every

integer

N/A

name

string / required

Object name.

one_time_password

string

N/A

os_name

string

Gateway platform operating system.

save_logs_locally

boolean

Save logs locally on the gateway.

Choices:

  • false

  • true

send_alerts_to_server

list / elements=string

Server(s) to send alerts to.

send_logs_to_backup_server

list / elements=string

Backup server(s) to send logs to.

send_logs_to_server

list / elements=string

Server(s) to send logs to.

state

string

State of the access rule (present or absent).

Choices:

  • "present" ← (default)

  • "absent"

tags

list / elements=string

Collection of tag identifiers.

threat_emulation

boolean

Threat Emulation blade enabled.

Choices:

  • false

  • true

threat_extraction

boolean

Threat Extraction blade enabled.

Available from R80.20.M2 management version.

Choices:

  • false

  • true

url_filtering

boolean

URL Filtering blade enabled.

Choices:

  • false

  • true

version

string

Version of checkpoint. If not given one, the latest version taken.

vpn

boolean

VPN blade enabled.

Choices:

  • false

  • true

vpn_settings

dictionary

Gateway VPN settings.

maximum_concurrent_ike_negotiations

integer

N/A

maximum_concurrent_tunnels

integer

N/A

wait_for_task

boolean

Wait for the task to end. Such as publish task.

Choices:

  • false

  • true ← (default)

wait_for_task_timeout

integer

How many minutes to wait until throwing a timeout error.

Default: 30

Examples

- name: add-simple-gateway
  cp_mgmt_simple_gateway:
    ip_address: 192.0.2.1
    name: gw1
    state: present

- name: set-simple-gateway
  cp_mgmt_simple_gateway:
    anti_bot: true
    anti_virus: true
    application_control: true
    ips: true
    name: test_gateway
    state: present
    threat_emulation: true
    url_filtering: true

- name: delete-simple-gateway
  cp_mgmt_simple_gateway:
    name: gw1
    state: absent

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

cp_mgmt_simple_gateway

dictionary

The checkpoint object created or updated.

Returned: always, except when deleting the object.

Authors

  • Or Soffer (@chkp-orso)